CVE-2024-47635

Vulnerability

Description A Cross-Site Request Forgery (CSRF) vulnerability exists in the TinyPNG WordPress plugin, versions from n/a through 3.4.3. The plugin lacks proper CSRF protection, allowing attackers to craft malicious requests that execute unwanted actions on behalf of authenticated users.

Exploitation

Conditions Exploitation requires a privileged user to interact with a crafted link or form, such as clicking a malicious link or submitting a forged form. No prior authentication from the attacker is needed; the attack leverages the victim's existing session.

Impact

Successful exploitation enables an attacker to force higher-privileged users (e.g., administrators) to perform actions without their consent, such as modifying plugin settings or uploading media files. This could lead to further compromise of the WordPress site.

Mitigation

The vulnerability is patched in version 3.4.4. Users are advised to update immediately. Patchstack users can enable auto-updates for the plugin to stay protected [1].