CVE Database /
CVE-2024-12636
CVE · Medium
CVE-2024-12636 — Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages [wplegalpages] < 3.2.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-12636
|
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages [wplegalpages] < 3.2.8 |
Cross-Site Request Forgery (CSRF) |
Medium
4.3
|
< 3.2.8
|
3.2.8 |
2024-12-24 |
—
|
CVE-2024-12636
The WP Legal Pages plugin through version 3.2.6 contains a cross-site request forgery vulnerability in the popup deletion functionality caused by insufficient nonce verification on the 'create_popup_delete_process' function. An unauthenticated attacker could exploit this flaw by crafting a malicious request that, if clicked by an administrator, would allow the deletion of popups without proper authorization. The vulnerability affects all versions up to and including 3.2.6, with fixes available in version 3.2.8 and later.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings