Medium severity6.1NVD Advisory· Published Jan 4, 2025· Updated Jun 17, 2026
CVE-2024-12279
CVE-2024-12279
Description
The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- cpe:2.3:a:wp_social_autoconnect_project:wp_social_autoconnect:*:*:*:*:*:wordpress:*:*Range: <4.6.3
<=4.6.2+ 1 more
- (no CPE)range: <=4.6.2
- (no CPE)
- justin_k/WP Social AutoConnectv5Range: 0
Patches
Vulnerability mechanics
References
3- plugins.trac.wordpress.org/changeset/3211577/nvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/392d8286-a5fd-4d5d-9f6a-f13564013edcnvdThird Party Advisory
- wordpress.org/plugins/wp-fb-autoconnect/nvdRelease Notes
News mentions
0No linked articles in our index yet.