CVE-2024-1360
The Colibri WP theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.94. This is due to missing or incorrect nonce validation on the colibriwp_install_plugin() function. This makes it possible for unauthenticated attackers to install recommended plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
We have discovered 23 live websites that are affected by CVE-2024-1360.
Affected Software
| Product |  Colibri WP |
| Category | Wordpress Themes |
| Vulnerable Versions |
|
| Total Vulnerable Versions | 83 |
| Vulnerable Domains | 23 live websites (0.23% of Colibri WP install base) |
Distribution by Website Rank
The diagram provides a graphic representation of the correlation between the occurrence of CVE-2024-1360 and the relative popularity of websitesDetails
- Published - Feb 23, 2024
- Updated - Feb 23, 2024
Credits
- Lucio Sá (finder)
CVE References
CWE References
Countries
 United States | 9 websites |
 Denmark | 2 websites |
 Spain | 2 websites |
 France | 2 websites |
 Belgium | 1 websites |
 Chile | 1 websites |
 GB | 1 websites |
 Italy | 1 websites |
 Japan | 1 websites |
 Netherlands | 1 websites |
TLDs
| .com | 11 websites |
| .dk | 2 websites |
| .co.uk | 1 websites |
| .es | 1 websites |
| .eu | 1 websites |
| .fr | 1 websites |
| .io | 1 websites |
| .it | 1 websites |
| .org | 1 websites |
| .se | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redGeographical Distribution
The distribution of websites across the globe that are exposed to CVE-2024-1360 through included software libraries and plugins.References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/db56844f-9988-4f6a-ba1d-f190ff009f2b?source=cve
- https://themes.trac.wordpress.org/changeset/218308/colibri-wp/1.0.101/inc/src/PluginsManager.php
Websites affected by CVE-2024-1360
Top websites that are affected by CVE-2024-1360. Please click on the "Contact us" button above to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ***********.com | United States | *,***,*** | |
| ***.******.com | Spain | *,***,*** | |
| ********.******.se |  Sweden | *,***,*** | |
| **********.io | United States | **,***,*** | |
| ****.*****.eu | Belgium | **,***,*** | |
| *********.**.uk | GB | **,***,*** | |
| *********.com | United States | **,***,*** | |
| **************.dk | Denmark | **,***,*** | |
| ************.com | France | **,***,*** | |
| ***.*********.com |  Turkey | **,***,*** |