CVE-2024-8093

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Posts reminder WordPress plugin through 0.20 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Posts reminder	<= 0.20
lucas_garcia	posts_reminder	<= 0.20

References

https://wpscan.com/vulnerability/c7fd690a-5f02-491c-a3fb-6eac9ffffe96/Exploit, Third Party Advisory

Timeline

Published: Sep 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-80946.5The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to CVE-2024-80956.1The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which c CVE-2024-80966.5When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certifi CVE-2024-80976.7Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Payara Platform Payara Server (Logging modules) allows Sensitive CVE-2024-80998.3A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An atta CVE-2024-81008.7On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privil CVE-2024-81016.1A stored cross-site scripting (XSS) vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability ar CVE-2024-81028.8The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to pr CVE-2024-81035.4The WP Category Dropdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, CVE-2024-81046.5The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includ CVE-2024-81056.4A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corr CVE-2024-81066.5The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,