CVE-2024-37102

CVE-2024-37102 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Blossom Themes Vilva WordPress theme. It affects Vilva versions from unspecified initial releases through 1.2.2. The issue enables forged requests to perform unauthorized actions within the theme's functionality.

The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating network accessibility, low attack complexity, no required privileges, and reliance on user interaction with unchanged scope. Unauthenticated attackers can exploit it by tricking authenticated users into submitting malicious requests, resulting in low-impact integrity effects such as unauthorized data modifications.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/vilva/vulnerability/wordpress-vilva-theme-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve, which documents the issue and associated remediation steps for the affected theme versions.