{"id":"CVE-2024-6244","state":"PUBLISHED","title":"pz-frontend-manager < 1.0.6 - CSRF change user profile picture","description":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks","publishedAt":"2024-07-22T06:00:06.341Z","updatedAt":"2025-03-19T19:30:02.061Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"WPScan","products":["Unknown PZ Frontend Manager"],"affected":[{"vendor":"Unknown","product":"PZ Frontend Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.6","versionType":"semver"}]}],"references":["https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6244.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-6244","state":"PUBLISHED","datePublished":"2024-07-22T06:00:06.341Z","dateUpdated":"2025-03-19T19:30:02.061Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2024-06-21T14:37:00.875Z"},"containers":{"cna":{"title":"pz-frontend-manager < 1.0.6 - CSRF change user profile picture","descriptions":[{"lang":"en","value":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks"}],"affected":[{"vendor":"Unknown","product":"PZ Frontend Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.0.6","versionType":"semver"}]}],"references":[{"url":"https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/","tags":["exploit","vdb-entry","technical-description"]}],"problemTypes":[{"descriptions":[{"description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateUpdated":"2024-07-22T06:00:06.341Z"},"credits":[{"lang":"en","value":"Vuln Seeker Cybersecurity Team","type":"finder"},{"lang":"en","value":"WPScan","type":"coordinator"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"WPScan CVE Generator"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"wordpress_plugin","product":"pz_frontend_manager","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"1.0.6","versionType":"semver"}],"cpes":["cpe:2.3:a:wordpress_plugin:pz_frontend_manager:*:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-07-29T16:50:33.482174Z","id":"CVE-2024-6244","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-19T19:30:02.061Z"}},{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/","tags":["exploit","vdb-entry","technical-description","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:33:05.242Z"}}]}}}