Description
The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for unauthenticated attackers to clear the patterns cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vektor-inc | VK Block Patterns | ≤ 1.31.1.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
kodaichodai/CVE-2024-0623 ★ 0 · Sep 11, 2024
a PoC for CVE-2024-0623/WP Plugin - VK Block Patterns (<= 1.31.1.1)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.