CVE-2024-3971 Similarity <= 3.0 - Plugin Reset via CSRF

2024-06-1406:00:03

WPScan

github.com

cve-2024-3971

similarity plugin

csrf vulnerability

wordpress

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

17.5%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Similarity",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "3.0"
      }
    ],
    "defaultStatus": "affected"
  }
]