CVE-2024-12554
Published
CVSS v3
5.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Peter’s Custom Anti-Spam plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on the cas_register_post() function. This makes it possible for unauthenticated attackers to blacklist emails via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
<p>Stop a lot of spambots from polluting your site by making visitors identify a random word displayed as an image before commenting and optionally before registering. You can customize the pool of words to display.</p>
<h4>Features</h4>
<ul>
<li>
<p>Toggle whether registered users need to enter the word</p>
</li>
<li>
<p>Random font display</p>
</li>
<li>
<p>No cookies required</p>
</li>
<li>
<p>No JavaScript required</p>
</li>
<li>
<p>Auto-generated audio for visually impaired users</p>
</li>
<li>
<p>Easy-to-read</p>
</li>
<li>
<p>No mapping of words from the code — words are used once or removed after 24 hours</p>
</li>
<li>
<p>Reminder of what was entered if you get the word wrong</p>
</li>
<li>
<p>Selective blocking of trackbacks, pingbacks</p>
</li>
<li>
<p>Easy to translate</p>
</li>
<li>
<p>Compatible with caching plugins</p>
</li>
</ul>
<h4>Negatives</h4>
<ul>
<li>
<p>Purposely no obscuring techniques so that the anti-spam word is easy to read</p>
</li>
<li>
<p>The more people who use this plugin, the more motivation for spambots to target it</p>
</li>
</ul>
<h4>Requirements</h4>
<ul>
<li>
<p>GD Library and FreeType Library (There’s a diagnostic page to tell you whether you have them installed. If needed, just ask your web host to install them!)</p>
</li>
<li>
<p>WordPress 3.2 or higher</p>
</li>
</ul>
<h4>Translations</h4>
<ul>
<li>ru_RU translation by koc</li>
<li>sk_SK translation by Patrik Žec (PATWIST) of http://patwist.com</li>
</ul>
WordPress Plugin Directory