Description
The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the edit_clarity_project_id() function. This makes it possible for unauthenticated attackers to change the project id and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| microsoft | Microsoft Clarity | ≤ 0.9.3 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
kodaichodai/CVE-2024-0590 ★ 0 · Sep 11, 2024
a PoC for CVE-2024-0590/WP Plugin - Microsoft Clarity (<= 0.9.3)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.