CVE-2024-13683

MEDIO 4.3CVE-2024-13683 · Published 24/01/2025 · updated 17/06/2026

In breve

CVE-2024-13683 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda automate hub (sperse).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.19%, superiore al 9.2% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
automate hub sperse	`≤ 1.7.0`	No fix yet

Description

The Automate Hub Free by Sperse.IO plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on the 'automate_hub' page. This makes it possible for unauthenticated attackers to update an activation status via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

plugins.trac.wordpress.org/browser/automate-hub-free-by-sperse-io/trunk/apps/s/sperse/sperse.php · Patch
wordpress.org/plugins/automate-hub-free-by-sperse-io · Product
wordfence.com/threat-intel/vulnerabilities/id/f6d90ca3-dc24-4634-9f98-83a909e3e093 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free