CVE-2024-13518

Name of the Vulnerable Software and Affected Versions Simple:Press Forum plugin for WordPress versions prior to 6.10.12

Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sp save edited post function. This allows unauthenticated attackers to modify a forum post via a forged request if they can trick a site administrator into performing a specific action.

Recommendations For versions prior to 6.10.12, update to version 6.10.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the sp save edited post function to minimize the risk of exploitation.