CVEvulnerability
CVE-2024-0858
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-03-18
- Last modified
- 2026-10-16
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-352
Description
The Innovs HR WordPress plugin before 1.0.3.7.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees.
Affected configurations
• theinnovs innovs hr (<= 1.0.3.4)
Related
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://wpscan.com/vulnerability/f6627a35-d158-495e-9d56-69405cfca221/ Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/f6627a35-d158-495e-9d56-69405cfca221/ Exploit, Third Party Advisory