{"id":"CVE-2024-5028","state":"PUBLISHED","title":"CM WordPress Search And Replace Plugin < 1.3.9 - Plugin Reset via CSRF","description":"The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks","publishedAt":"2024-07-13T06:00:07.447Z","updatedAt":"2024-08-01T21:03:09.657Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown CM WordPress Search And Replace Plugin"],"affected":[{"vendor":"Unknown","product":"CM WordPress Search And Replace Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.9","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/0bae8494-7b01-4203-a4f7-ccc60efbdda7/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/5xxx/CVE-2024-5028.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-5028","state":"PUBLISHED","datePublished":"2024-07-13T06:00:07.447Z","dateUpdated":"2024-08-01T21:03:09.657Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2024-05-16T18:56:23.800Z"},"containers":{"cna":{"title":"CM WordPress Search And Replace Plugin < 1.3.9 - Plugin Reset via CSRF","descriptions":[{"lang":"en","value":"The CM WordPress Search And Replace Plugin WordPress plugin before 1.3.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks"}],"affected":[{"vendor":"Unknown","product":"CM WordPress Search And Replace Plugin","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.9","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0bae8494-7b01-4203-a4f7-ccc60efbdda7/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-07-13T06:00:07.447Z"},"credits":[{"lang":"en","value":"Felipe Caon","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"creativemindssolutions","product":"search_and_replace","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.3.9","versionType":"semver"}],"cpes":["cpe:2.3:a:creativemindssolutions:search_and_replace:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-07-13T22:52:41.564334Z","id":"CVE-2024-5028","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-13T22:54:14.789Z"}},{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/0bae8494-7b01-4203-a4f7-ccc60efbdda7/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:03:09.657Z"}}]}}}