CVE-2024-12545

Description

The Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.1. This is due to missing nonce validation on the reset_installation() function. This makes it possible for unauthenticated attackers to reset the plugin’s installation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Reserved 2024-12-11 | Published 2025-01-04 | Updated 2025-01-06 | Assigner Wordfence

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

*
affected

Timeline

2025-01-03:

Disclosed

Credits

Peter Thaleikis finder

References

www.wordfence.com/...-4f1b-4212-9e5c-dd10dd443df7?source=cve

plugins.trac.wordpress.org/...gs/2.7.0/includes/swin-api.php

wordpress.org/...scratch-win-giveaways-for-website-facebook/

plugins.trac.wordpress.org/changeset/3212730/

cve.org (CVE-2024-12545)

nvd.nist.gov (CVE-2024-12545)

Download JSON