What the vulnerability does
01Description
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
Cooked versions before 1.8.0 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires the victim to visit the attacker's page while authenticated. This can lead to unauthorized changes to site configuration or data.
What an attacker can do
03Attacker Capabilities
Trick a logged-in admin into performing unwanted actions on the site by visiting a malicious webpage.
Potential impact on your site
04Site Impact
Administrators could unknowingly authorize malicious changes to site settings or data if tricked into visiting a compromised page.
Conditions required to exploit
05Prerequisites
Victim must be logged in to the site and visit an attacker-controlled webpage.
Key dates
06Disclosure timeline
July 17, 2024
CVE published
August 2, 2024
Record updated
