CVE-2024-0428

The Index Now plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.3. This is due to missing or incorrect nonce validation on the ‘reset_form’ function. This makes it possible for unauthenticated attackers to delete arbitrary site options via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

More information : https://plugins.trac.wordpress.org/changeset/3020958/mihdan-index-now/tags/2.6.4/src/Views/WPOSA.php

Attack vector : NETWORK
Attack complexity : LOW
Privileges required : NONE
User interaction : REQUIRED
Confidentiality impact : HIGH
Integrity impact : HIGH
Base score : 8.8
Base severity : HIGH
Exploitability score : 2.8
Impact score : 5.9