CVE-2024-9588: CWE-352 Cross-Site Request Forgery (CSRF) in amu02aftab Category and Taxonomy Meta Fields
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a link.
AI Analysis
Technical Summary
CVE-2024-9588 is a CSRF vulnerability in the WordPress plugin 'Category and Taxonomy Meta Fields' (amu02aftab) affecting versions up to 1.0.0. The vulnerability arises from missing or incorrect nonce validation in the 'wpaft_option_page' function, which handles taxonomy meta operations. An attacker can exploit this by tricking an authenticated site administrator into clicking a malicious link, causing unauthorized addition or deletion of taxonomy meta data. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Potential Impact
Successful exploitation allows an attacker to modify taxonomy meta data on a vulnerable WordPress site without authentication by leveraging an administrator's interaction. This can lead to unauthorized changes in site metadata, potentially affecting site behavior or content categorization. There is no direct confidentiality impact, but integrity and availability impacts are rated as low.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Site administrators should exercise caution and avoid clicking on untrusted links while logged into the WordPress admin interface. Monitor the vendor's advisory channels for updates regarding a patch or official remediation. Until a fix is released, limiting administrator exposure to untrusted content is recommended.
CVE-2024-9588: CWE-352 Cross-Site Request Forgery (CSRF) in amu02aftab Category and Taxonomy Meta Fields
Description
The Category and Taxonomy Meta Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the 'wpaft_option_page' function. This makes it possible for unauthenticated attackers to add and delete taxonomy meta, granted they can trick a site administrator into performing an action such as clicking on a link.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-9588 is a CSRF vulnerability in the WordPress plugin 'Category and Taxonomy Meta Fields' (amu02aftab) affecting versions up to 1.0.0. The vulnerability arises from missing or incorrect nonce validation in the 'wpaft_option_page' function, which handles taxonomy meta operations. An attacker can exploit this by tricking an authenticated site administrator into clicking a malicious link, causing unauthorized addition or deletion of taxonomy meta data. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.
Potential Impact
Successful exploitation allows an attacker to modify taxonomy meta data on a vulnerable WordPress site without authentication by leveraging an administrator's interaction. This can lead to unauthorized changes in site metadata, potentially affecting site behavior or content categorization. There is no direct confidentiality impact, but integrity and availability impacts are rated as low.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Site administrators should exercise caution and avoid clicking on untrusted links while logged into the WordPress admin interface. Monitor the vendor's advisory channels for updates regarding a patch or official remediation. Until a fix is released, limiting administrator exposure to untrusted content is recommended.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-10-07T16:34:06.072Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6b52b7ef31ef0b55229c
Added to database: 2/25/2026, 9:36:18 PM
Last enriched: 4/9/2026, 8:37:52 PM
Last updated: 4/12/2026, 2:00:17 PM
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.