CVE-2024-1642

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Mar 13, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-16439.1By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data wCVE-2024-16448.8Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LFI.CVE-2024-16454.3The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistratiCVE-2024-16468.2parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checksCVE-2024-16477.5Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application doeCVE-2024-16487.5electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application CVE-2024-16494.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16504.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16519.8Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to inseCVE-2024-16524.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16534.3The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjCVE-2024-16547.2This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have a