{"id":"CVE-2024-6244","aliases":["EUVD-2024-47372","GHSA-wqq7-m9hm-p4xw"],"status":"published","title":"pz-frontend-manager \u003c 1.0.6 - CSRF change user profile picture","description":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03544,"percentile":0.89394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-352"],"published":"2024-07-22T06:00:06Z","modified":"2026-06-17T08:17:37Z","exploits":[{"source":"exploitdb","id":"EDB-52153","title":"PZ Frontend Manager WordPress Plugin 1.0.5 - Cross Site Request Forgery (CSRF)","type":"webapps","platform":"php","date":"2025-04-09","url":"https://www.exploit-db.com/exploits/52153"},{"source":"pocgithub","id":"Nxploited/CVE-2024-6244","title":"Nxploited/CVE-2024-6244","date":"2025-02-08","url":"https://github.com/Nxploited/CVE-2024-6244"}],"products":[{"vendor":"projectzealous","product":"pz_frontend_manager"},{"vendor":"projectzealous01","product":"pz frontend manager"},{"vendor":"unknown","product":"pz frontend manager"},{"vendor":"wordpress_plugin","product":"pz_frontend_manager"}],"references":[{"url":"https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6244"},{"url":"https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732"},{"url":"https://github.com/advisories/GHSA-wqq7-m9hm-p4xw"}],"sources":{"cve":[{"id":"CVE-2024-6244","title":"pz-frontend-manager \u003c 1.0.6 - CSRF change user profile picture","description":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks","status":"published","published":"2024-07-22T06:00:06.341Z","modified":"2025-03-19T19:30:02.061Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:10.961618Z"}],"euvd":[{"id":"EUVD-2024-47372","description":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks","status":"published","published":"2024-07-22T06:00:06Z","modified":"2025-03-19T19:30:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:58.209763Z"}],"ghsa":[{"id":"GHSA-wqq7-m9hm-p4xw","title":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places,...","description":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks","status":"published","published":"2024-07-22T06:31:09Z","modified":"2024-07-25T15:30:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:57:44.645006Z"}],"nvd":[{"id":"CVE-2024-6244","description":"The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks","status":"published","published":"2024-07-22T06:15:02.737Z","modified":"2026-06-17T08:17:37.013Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:13.413515Z"}]}}