CVE-2024-1315

CVE-2024-1315 is a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to 3.0.4 of the Classified Listing – Classified ads & Business Directory Plugin for WordPress. This flaw stems from inadequate nonce validation in the 'rtcl_update_user_account' function. An unauthenticated attacker can exploit this by tricking a site administrator into clicking a malicious link, allowing them to change the administrator's password and email, effectively locking them out and gaining unauthorized access. The vulnerability carries a high CVSS score of 8.8, indicating a critical risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Successful exploitation grants the attacker full control over the compromised administrator account. Currently, there is no evidence of active exploitation, nor are there any publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting low public awareness at this time.