CVE-2024-3590

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-359005.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject new basechain after table flag update WheCVE-2024-359015.5In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skb_over_panic mana_get_rxbuf_cfg()CVE-2024-359025.5In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cpCVE-2024-359035.5In the Linux kernel, the following vulnerability has been resolved: x86/bpf: Fix IP after emitting call depth accounting Adjust the IP pasCVE-2024-359045.5In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereference of garbage after mount failure In case kernCVE-2024-359057.8In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-CVE-2024-359075.5In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: call request_irq() after NAPI initialized The mlxbf_gige dCVE-2024-359085.5In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak At the start of tCVE-2024-359095.5In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Split 64bit accesses to fix alignment issues Some of CVE-2024-35916.5The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allowCVE-2024-359105.8In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzboCVE-2024-359117.8In the Linux kernel, the following vulnerability has been resolved: ice: fix memory corruption bug with suspend and rebuild The ice driver
CVE-2024-3590: Medium severity, CVSS 6.1 | Vulnix