CVE-2024-37940 HIGH

CVE-2024-37940: WordPress Seraphinite Accelerator (Full, premium) plugin <= 2.21.13 - CSRF Leading to Arbitrary File Deletion vulnerability

Vendor Seraphinite Solutions
Product Seraphinite Accelerator (Full, premium)
Weakness CWE-352 · CSRF
Published July 12, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Accelerator (Full, premium).This issue affects Seraphinite Accelerator (Full, premium): from n/a through 2.21.13.

Explanation of Vulnerability in Simple Terms

02Summary

Seraphinite Accelerator versions up to 2.21.13 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick a site administrator into performing unwanted actions. The attacker must craft a malicious link or page and convince an admin to visit it while logged in. This can lead to site unavailability or disruption of service.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into performing unwanted actions that disrupt site availability.

Potential impact on your site

04Site Impact

An admin could unknowingly trigger actions that cause site downtime or service disruption.

Conditions required to exploit

05Prerequisites

Admin must visit attacker-controlled page while logged into the site.

Key dates

06Disclosure timeline

July 12, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-61981 WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2016-20083 WordPress More Fields Plugin 2.1 Cross-Site Request Forgery CVE-2026-65471 WordPress Avada Core plugin <= 5.15.6 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-24537 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.6 - Cross Site Request Forgery (CSRF) vulnerability