WordPress Podlove Podcast Publisher प्लगइन <= 4.1.13 - CSRF से रिमोट कोड एग्जीक्यूशन (RCE) भेद्यता

The CSRF vulnerability in Podlove Podcast Publisher allows an attacker to craft malicious requests that, when successfully executed by an authenticated user, can lead to arbitrary code execution on the server. This means an attacker could potentially gain full control of the WordPress site, including access to sensitive data, modification of content, and installation of malware. The impact is particularly severe because WordPress sites often host valuable data and are critical for business operations. Successful exploitation could lead to data breaches, website defacement, and significant reputational damage.

WordPress websites utilizing the Podlove Podcast Publisher plugin, particularly those running versions prior to 4.1.14, are at significant risk. Shared hosting environments where multiple websites share the same server are also at increased risk, as a compromise of one site could potentially lead to the compromise of others. Sites with limited user access controls or those that haven't implemented robust CSRF protection measures are especially vulnerable.

• wordpress / composer / npm:

grep -r 'podlove_podcast_publisher' /var/www/html/wp-content/plugins/
wp plugin list | grep podlove_podcast_publisher

• generic web:

curl -I https://your-wordpress-site.com/wp-admin/admin-ajax.php?action=podlove_api_get_podcast_chapters&podcast_id=1 | grep Server

1. 2024-10-31Disclosure

   disclosure

1. आरक्षित2024-08-18
2. प्रकाशित2024-10-31
3. संशोधित2024-11-01
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-43984 is to immediately upgrade Podlove Podcast Publisher to version 4.1.14 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing strict CSRF protection measures on the WordPress site. This might involve using a WordPress security plugin with robust CSRF protection or implementing custom code to validate and sanitize user input. Additionally, review WordPress user permissions to limit the impact of a potential compromise. After upgrading, confirm the fix by attempting to trigger the vulnerable endpoint with a CSRF token and verifying that the action is denied.

सक्रिय इंस्टॉलेशन

3Kज्ञात

प्लगइन रेटिंग