CVE-2024-12383

Description

The Binary MLM Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'bmw_display_pv_set_page' function and insufficient input sanitization and output escaping of the 'product_points' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Reserved 2024-12-09 | Published 2025-01-07 | Updated 2025-01-07 | Assigner Wordfence

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

*
affected

Timeline

2025-01-06:

Disclosed

Credits

Colin Xu finder

References

www.wordfence.com/...-4bb3-4ccc-ba90-1e947365435e?source=cve

plugins.trac.wordpress.org/...cludes/admin/point_setting.php

plugins.trac.wordpress.org/...cludes/admin/point_setting.php

plugins.trac.wordpress.org/...cludes/admin/point_setting.php

cve.org (CVE-2024-12383)

nvd.nist.gov (CVE-2024-12383)

Download JSON