CVE-2024-0858: CWE-352 Cross-Site Request Forgery (CSRF) in Innovs HR
Description
CVE-2024-0858 is a high severity vulnerability in the Innovs HR WordPress plugin prior to version 1.0.3.7.1. The plugin lacks proper Cross-Site Request Forgery (CSRF) protections in certain areas, which could allow attackers to trick logged-in users into performing unintended actions, such as adding themselves as employees.
CVSS v3.1
Score 8.8high
Affected software
Innovs HR
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Innovs HR WordPress plugin versions before 1.0.3.7.1 do not implement CSRF checks in some functionalities. This absence of CSRF protection enables attackers to craft malicious requests that, when executed by authenticated users, can perform unauthorized actions within the plugin, including the addition of employees without user consent.
Potential Impact
Successful exploitation of this vulnerability could lead to unauthorized modification of plugin data by leveraging authenticated users' privileges. Specifically, attackers could add employees to the system without proper authorization, potentially compromising the integrity and trustworthiness of the HR data. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Users should upgrade the Innovs HR plugin to version 1.0.3.7.1 or later where this vulnerability is fixed. Since the affected versions are explicitly stated, applying the official update is the recommended remediation. No information about alternative mitigations or temporary fixes is provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2024-01-24T11:59:39.530Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad20ba72cdf04f656e6c853
Added to database: 10/16/2026, 11:33:59 UTC
Last enriched: 10/16/2026, 11:48:15 UTC
Last updated: 10/16/2026, 19:03:29 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.