CVE-2024-2969 MEDIUM

CVE-2024-2969: WP-Eggdrop <= 0.1 - Cross-Site Request Forgery to Settings Update

Vendor Backie
Product WP-Eggdrop
Weakness CWE-352 · CSRF
Published March 29, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the wpegg_updateOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Key dates

02Disclosure timeline

March 29, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-32484 WordPress WP-Planification – WP-Planning plugin <= 2.3.1 - CSRF to Stored XSS vulnerability CVE-2025-25088 WordPress WP Keyword Monitor Plugin <=1.0.5 - CSRF to Stored XSS vulnerability CVE-2025-26768 WordPress what3words Address Field plugin <= 4.0.15 - CSRF to Stored XSS vulnerability CVE-2025-4282 SourceCodester/oretnom23 Stock Management System Users.php cross-site request forgery CVE-2025-62986 WordPress FanBridge signup plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability