{"id":"CVE-2024-9689","aliases":["EUVD-2024-50093","GHSA-pcmq-5pjg-9prg"],"status":"published","title":"Post From Frontend \u003c= 1.0.0 - Post Deletion via CSRF","description":"The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00222,"percentile":0.12795,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-11-05T06:00:08Z","modified":"2026-06-17T08:25:04Z","products":[{"vendor":"shaon","product":"post_from_frontend"},{"vendor":"unknown","product":"post from frontend"}],"references":[{"url":"https://wpscan.com/vulnerability/ea501d37-1ec2-43ec-873a-ec204e965f60/","tags":["exploit","vdb-entry","technical-description","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9689"},{"url":"https://wpscan.com/vulnerability/ea501d37-1ec2-43ec-873a-ec204e965f60"},{"url":"https://github.com/advisories/GHSA-pcmq-5pjg-9prg"}],"sources":{"cve":[{"id":"CVE-2024-9689","title":"Post From Frontend \u003c= 1.0.0 - Post Deletion via CSRF","description":"The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-05T06:00:08.314Z","modified":"2024-11-07T19:56:59.998Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:06.48311Z"}],"euvd":[{"id":"EUVD-2024-50093","description":"The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-05T06:00:08Z","modified":"2024-11-07T19:56:59Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:05:07.826667Z"}],"ghsa":[{"id":"GHSA-pcmq-5pjg-9prg","title":"The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting...","description":"The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-05T06:30:34Z","modified":"2024-11-06T21:31:58Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:58:45.353191Z"}],"nvd":[{"id":"CVE-2024-9689","description":"The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack","status":"published","published":"2024-11-05T06:15:06.36Z","modified":"2026-06-17T08:25:04.243Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:10:35.864552Z"}]}}