CVE-2024-1230

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybe_disconnect_simpleshop function. This makes it possible for unauthenticated attackers to disconnect the site from simpleshop via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
redbitczSimpleShop<= 2.10.0
redbit_srosimple_shop<= 2.10.0

References

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-123003.7The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on thCVE-2024-123016.5The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in uCVE-2024-123026.1The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors andCVE-2024-123035.5An issue has been discovered in GitLab CE/EE affecting all versions from 17.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 thatCVE-2024-123045.4The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via butCVE-2024-123054.3An object-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows unauthorized access to CVE-2024-123064.3Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personCVE-2024-123074.3A function-level access control vulnerability in Unifiedtransform version 2.0 and potentially earlier versions allows teachers to modify stuCVE-2024-123085.4The Logo Slider WordPress plugin before 4.6.0 does not validate and escape some of its shortcode attributes before outputting them back in CVE-2024-123095.3The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions uCVE-2024-12316.8The CM Download Manager WordPress plugin before 2.9.0 does not have CSRF checks in some places, which could allow attackers to make logged CVE-2024-123107.0A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk