CVE-2024-39623

CVE-2024-39623 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the CridioStudio ListingPro WordPress theme. This issue affects ListingPro versions from n/a through 2.9.4 and allows authentication bypass. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, no required privileges, and high impacts across confidentiality, integrity, and availability.

Attackers can exploit this vulnerability remotely without authentication by tricking authenticated users into interacting with a malicious site or resource, such as clicking a crafted link. This user interaction enables the CSRF attack, resulting in authentication bypass and potential account takeover.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-3-cross-site-request-forgery-csrf-to-account-takeover-vulnerability?_s_id=cve.