CVE-2024-6244

pz-frontend-manager < 1.0.6 - CSRF change user profile picture

The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Affected

PZ Frontend Manager

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

3.18% chance of exploitation in the next 30 days, 88th percentile

Published

2024-07-22

Updated

2025-03-19

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/
• Nxploited/CVE-2024-62440★ · 2025-02-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52153

Security advisories

• https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732

References

• CVE Record
• NVD entry