CVE-2024-31386 MEDIUM

CVE-2024-31386: Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability

Vendor Hidekazu Ishikawa

Product X-T9

Weakness CWE-352 · CSRF

Published April 10, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Hidekazu Ishikawa X-T9, Hidekazu Ishikawa Lightning, themeinwp Default Mag, Out the Box Namaha, Out the Box CityLogic, Marsian i-max, Jetmonsters Emmet Lite, Macho Themes Decode, Wayneconnor Sliding Door, Out the Box Shopstar!, Modernthemesnet Gridsby, TT Themes HappenStance, Marsian i-excel, Out the Box Panoramic, Modernthemesnet Sensible WP.This issue affects X-T9: from n/a through 1.19.0; Lightning: from n/a through 15.18.0; Default Mag: from n/a through 1.3.5; Namaha: from n/a through 1.0.40; CityLogic: from n/a through 1.1.29; i-max: from n/a through 1.6.2; Emmet Lite: from n/a through 1.7.5; Decode: from n/a through 3.15.3; Sliding Door: from n/a through 3.3; Shopstar!: from n/a through 1.1.33; Gridsby: from n/a through 1.3.0; HappenStance: from n/a through 3.0.1; i-excel: from n/a through 1.7.9; Panoramic: from n/a through 1.1.56; Sensible WP: from n/a through 1.3.1.

Explanation of Vulnerability in Simple Terms

02Summary

X-T9 versions up to 1.19.0 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unwanted actions on behalf of a logged-in user. The vulnerability requires the user to visit a malicious webpage while authenticated. An attacker can modify site data or settings, but cannot read sensitive information or cause service disruption.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions (modify data or settings) on behalf of a logged-in user.

Potential impact on your site

04Site Impact

Authenticated users' actions can be hijacked to change site configuration or data without their knowledge.

Conditions required to exploit

05Prerequisites

User must be logged in and visit an attacker-controlled webpage.

Key dates

06Disclosure timeline

April 10, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-31386 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities

Identifiers

CVE CVE-2024-31386

CWE CWE-352

CVSS 4.3 / MEDIUM

Affected versions

Vendor Hidekazu Ishikawa

Product X-T9

Affected ≥ n/a and ≤ 1.19.0

Vendor Hidekazu Ishikawa

Product Lightning

Affected ≥ n/a and ≤ 15.18.0

Vendor Themeinwp

Product Default Mag

Affected ≥ n/a and ≤ 1.3.5

Vendor Out The Box

Product Namaha

Affected ≥ n/a and ≤ 1.0.40

Vendor Out The Box

Product CityLogic

Affected ≥ n/a and ≤ 1.1.29

Vendor Marsian

Product i-max

Affected ≥ n/a and ≤ 1.6.2

Vendor Jetmonsters

Product Emmet Lite

Affected ≥ n/a and ≤ 1.7.5

Vendor Macho Themes

Product Decode

Affected ≥ n/a and ≤ 3.15.3

Vendor Wayneconnor

Product Sliding Door

Affected ≥ n/a and ≤ 3.3

Vendor Out The Box

Product Shopstar!

Affected ≥ n/a and ≤ 1.1.33

Vendor Modernthemesnet

Product Gridsby

Affected ≥ n/a and ≤ 1.3.0

Vendor Tt Themes

Product HappenStance

Affected ≥ n/a and ≤ 3.0.1

Vendor Marsian

Product i-excel

Affected ≥ n/a and ≤ 1.7.9

Vendor Out The Box

Product Panoramic

Affected ≥ n/a and ≤ 1.1.56

Vendor Modernthemesnet

Product Sensible WP

Affected ≥ n/a and ≤ 1.3.1

CVE-2024-31386: Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability

01Description

02Summary

03Attacker Capabilities

04Site Impact

05Prerequisites

06Disclosure timeline

07References

08Related CVE