5.3
CVE-2024-13338
- EPSS 0.13%
- Veröffentlicht 12.04.2025 06:37:19
- Zuletzt bearbeitet 08.07.2025 18:34:56
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginWebcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache
Webcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache
The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfy_cache_delete functionality . This makes it possible for unauthenticated attackers to clear the cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mögliche Gegenmaßnahme
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer: Update to version 2.3.2, or a newer patched version
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.13% | 0.032 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
|
| security@wordfence.com | 5.3 | 3.9 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a37ce4-9860-415e-bb88-545c30c95fc1?source=cve
https://plugins.trac.wordpress.org/changeset/3268278/clearfy/trunk/components/cache/includes/cache.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/e0a37ce4-9860-415e-bb88-545c30c95fc1