CVE-2024-13753
Published: 20 February 2025
Description
The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the update_profile function. This makes it possible for unauthenticated attackers to modify victim's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an action such as clicking on a link.
Security Summary
CVE-2024-13753 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the Ultimate Classified Listings plugin for WordPress in all versions up to and including 1.5. The issue arises from missing or incorrect nonce validation in the update_profile function, enabling forged requests to alter user data.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no privileges required, though user interaction is needed, as reflected in its CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). By tricking a victim into actions like clicking a malicious link, attackers can modify the victim's email address via a forged request, potentially leading to account takeover.
Plugin references include source code from version 1.4 and a changeset comparing versions 1.5 and 1.6, indicating that the vulnerability was addressed in version 1.6. Wordfence's threat intelligence page provides further details on the issue, recommending updates to patched versions for mitigation.
Details
- CWE(s)