CVE-2024-4758

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

The Muslim Prayer Time BD WordPress plugin through 2.4 does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Muslim Prayer Time BD	<= 2.4
muslim_prayer_time_bd	muslim_prayer_time_bd	<= 2.4

References

https://wpscan.com/vulnerability/64ec57a5-35d8-4c69-bdba-096c2245a0db/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/64ec57a5-35d8-4c69-bdba-096c2245a0db/Exploit, Third Party Advisory

Timeline

Published: Jun 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-475806.8An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the CVE-2024-475814.3SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in esc CVE-2024-475825.3Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expa CVE-2024-475854.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should h CVE-2024-475865.3SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request wh CVE-2024-475873.5Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low CVE-2024-475884.7In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are wri CVE-2024-47595.5The Mime Types Extended WordPress plugin through 0.11 does not sanitise uploaded SVG files, which could allow users with a role as low as Au CVE-2024-475908.8An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this CVE-2024-475925.3SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs CVE-2024-475934.3SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise CVE-2024-475945.4SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability i