CVE-2024-0623 - CVE House

Back to Database

Status published Medium CVE-2024-0623

VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery

4.3 CVSS

Vulnerability Description

The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for unauthenticated attackers to clear the patterns cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-0623

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Kodai Kubono

References

More from vektor-inc

View All →

VK Google Job Posting Manager <= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field

VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure

VK Blocks <= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block

VK Filter Search <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

Affected Vendor

vektor-inc

View all reports →

Affected Software

VK Block Patterns

Vulnerable Versions:

0

Timeline

Official Publish: January 20th, 2024

Last Modified: April 8th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link

T1204.001 Malicious Link

T1098 Account Manipulation

T1565.001 Stored Data Manipulation