CVE-2024-135114.3MediumCWE-352

CVE-2024-13511: Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Reset

themehunk · Variation Swatches for WooCommerce

Affected: themehunk Variation Swatches for WooCommerce · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

9th percentile

050100

Higher than 9% of scored CVEs

4.3MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerability due to improper nonce verification in its settings reset functionality. The issue exists in the settings_init() function, which processes a reset action based on specific query parameters in the URL. The related delete_settings() function performs a faulty nonce validation check, making the reset operation insecure and susceptible to unauthorized access.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

themehunk · Variation Swatches for WooCommercefrom 1.0.8 up to and including 1.3.2

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Cross-Site Request Forgery
Vendor: themehunk
Published: January 2025
Band: Unlikely (under 1%), January 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2024-13511 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.