CVE-2024-54418 MEDIUM

CVE-2024-54418: WordPress DTC Documents plugin <= 1.1.05 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Diversified Technology Corp.
Product DTC Documents
Weakness CWE-352 · CSRF
Published December 16, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp. DTC Documents dtc-documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through <= 1.1.05.

Explanation of Vulnerability in Simple Terms

02Summary

DTC Documents versions 1.1.05 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in user, performs unwanted actions on their behalf—such as modifying documents or settings. The vulnerability requires user interaction (visiting a link) but no special privileges. Integrity and availability of documents may be compromised.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions (modify or delete documents) on behalf of a logged-in user without their knowledge.

Potential impact on your site

04Site Impact

Users' documents and settings can be altered by attackers through forged requests; data integrity is at risk.

Conditions required to exploit

05Prerequisites

User must be logged into DTC Documents and visit an attacker-controlled webpage or click a malicious link.

Key dates

06Disclosure timeline

December 16, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-6455 WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter CVE-2024-32110 WordPress Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 4.1.2 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-9722 Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form CVE-2026-8422 Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update CVE-2026-8941 CDN Linker lite <= 1.3.1 - Cross-Site Request Forgery to Plugin Settings Update