VulnerabilityAnalyzed

CVE-2024-3163

The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

MEDIUM 4.3EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

The Easy Property Listings WordPress plugin before 3.5.4 does not have CSRF check when deleting contacts in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS: 0.23% probability · 13th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: realestateconnected/easy property listings
Source: contact@wpscan.com

References

https://wpscan.com/vulnerability/f89c8654-5486-4939-880d-101f33d359c0/Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.