blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-39680

HIGH 8.8 CVSS 3.1
Published
July 18, 2024
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
security-advisories@github.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • XjSv Cooked — Version < 1.8.0
  • boxystudio cooked — Before 1.8.0

References

  • github.com https://github.com/XjSv/Cooked/security/advisories/GHSA-f2mc-hcp9-6xgr Exploit, Vendor Advisory
  • nvd.nist.gov Official NVD record