CVE-2024-7501 affects the "Download Plugins and Themes in ZIP from Dashboard" WordPress plugin, specifically versions up to and including 1.8.7. This Cross-Site Request Forgery (CSRF) vulnerability stems from inadequate nonce validation within the download_theme() function. An unauthenticated attacker could trick a site administrator into clicking a malicious link, leading to the download of arbitrary themes. In versions prior to 1.8.6, this could even allow for the download of all site files. The vulnerability has a CVSS score of 4.2 (Medium), indicating a network-based attack with high attack complexity requiring user interaction, resulting in low confidentiality and integrity impacts. There is no evidence of active exploitation, nor is exploit code publicly available via Metasploit or Nuclei. Community discussion and media coverage for this CVE are currently minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Wpcodefactory | Download Plugins And Themes In ZIP From Dashboard | >= 0, <= 1.8.7CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.2 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.