CVE-2024-37103 MEDIUM

CVE-2024-37103: WordPress Education Zone theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Raratheme
Product Education Zone
Weakness CWE-352 · CSRF
Published January 2, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in raratheme Education Zone education-zone allows Cross Site Request Forgery.This issue affects Education Zone: from n/a through <= 1.3.4.

Explanation of Vulnerability in Simple Terms

02Summary

Education Zone through version 1.3.4 contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of authenticated users. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator or user, executes unintended operations without their knowledge or consent. This vulnerability requires user interaction and affects the integrity of site data.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions on the site by tricking a logged-in user into visiting a malicious link.

Potential impact on your site

04Site Impact

Site administrators or users could unknowingly perform actions like changing settings, creating content, or modifying data.

Conditions required to exploit

05Prerequisites

A logged-in user must visit an attacker-controlled page or click a malicious link while authenticated.

Key dates

06Disclosure timeline

January 2, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2016-20083 WordPress More Fields Plugin 2.1 Cross-Site Request Forgery CVE-2026-13243 Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063 CVE-2016-20074 WordPress Lazy Content Slider Plugin 3.4 CSRF CVE-2026-57635 WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-24537 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability