Vulnerability · Published Jan 27, 2025 · Assigned by WPScan

CVE-2024-12280WP Customer Area <= 8.2.4 - Event Log Deletion via CSRF

Medium 4.3

In plain English

A medium-severity cross-site request forgery in WP Customer Area from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 88.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The WP Customer Area WordPress plugin through 8.2.4 does not have CSRF check in place when deleting its logs, which could allow attackers to make a logged in to delete them via a CSRF attack

Affected products (as reported)

Vendor	Product	Versions
Unknown	WP Customer Area	0 – through 8.2.4

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/2b32c0b8-28bb-4220-800b-4c369bca91c5/ exploit, vdb-entry, technical-description