{"id":"CVE-2024-2970","aliases":["EUVD-2024-27910","GHSA-8wfj-3c3v-m8pr"],"status":"published","title":"News Wall \u003c= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update","description":"The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwap_newslist_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and modify news lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00202,"percentile":0.10232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-03-29T06:43:57Z","modified":"2026-06-17T07:25:55Z","products":[{"vendor":"tsina","product":"news wall"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/37331460-4585-4946-9256-64fdb8f02a6b?source=cve","tags":["x_transferred"]},{"url":"https://plugins.trac.wordpress.org/browser/news-wall/trunk/plugin-panel.php","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2970"},{"url":"https://github.com/advisories/GHSA-8wfj-3c3v-m8pr"}],"sources":{"cve":[{"id":"CVE-2024-2970","title":"News Wall \u003c= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update","description":"The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwap_newslist_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and modify news lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-03-29T06:43:57.638Z","modified":"2026-04-08T16:46:18.56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-27910","description":"The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwap_newslist_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and modify news lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-03-29T06:43:57Z","modified":"2026-04-08T16:46:18Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:03.268135Z"}],"ghsa":[{"id":"GHSA-8wfj-3c3v-m8pr","title":"The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up...","description":"The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwap_newslist_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and modify news lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-03-29T09:30:43Z","modified":"2026-04-08T18:32:51Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:07:13.380693Z"}],"nvd":[{"id":"CVE-2024-2970","description":"The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwap_newslist_page() function. This makes it possible for unauthenticated attackers to update the plugin's settings and modify news lists via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-03-29T07:15:46.85Z","modified":"2026-06-17T07:25:55.89Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:09:44.124823Z"}]}}