// For flags

CVE-2024-0379

Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctf_auto_save_tokens function. This makes it possible for unauthenticated attackers to update the site's twitter API token and secret via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

El complemento Custom Twitter Feeds – A Tweets Widget or X Feed Widget para WordPress es vulnerable a la Cross-Site Request Forgery en todas las versiones hasta la 2.2.1 incluida. Esto se debe a una validación nonce faltante o incorrecta en la función ctf_auto_save_tokens. Esto hace posible que atacantes no autenticados actualicen el token API de Twitter del sitio y el secreto a través de una solicitud falsificada, siempre que puedan engañar al administrador del sitio para que realice una acción como hacer clic en un enlace.

*Credits: Justin Gardner, Kodai Kubono
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-01-09 CVE Reserved
  • 2024-02-06 CVE Published
  • 2024-02-21 EPSS Updated
  • 2024-08-08 CVE Updated
  • 2024-09-11 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Smashballoon
Search vendor "Smashballoon"
 Custom Twitter Feeds – A Tweets Widget Or X Feed Widget
Search vendor "Smashballoon" for product "Custom Twitter Feeds – A Tweets Widget Or X Feed Widget"
 <= 2.2.1
Search vendor "Smashballoon" for product "Custom Twitter Feeds – A Tweets Widget Or X Feed Widget" and version " <= 2.2.1"
en
Affected