Security readout for executives and security teams
Plain-English summary
CVE-2024-24837 is a CSRF issue in three WordPress migration plugins from Frédéric GILLES. A successful attack would require a user to be tricked into an action while authenticated. The public record rates impact as medium, with low availability impact and no stated confidentiality or integrity impact.
Executive priority
Treat as a moderate WordPress hygiene item, not an emergency based on the provided evidence. Prioritize sites where these migration plugins remain installed after migration work, especially production sites with multiple administrators.
Technical view
The CVE maps to CWE-352 and affects FG PrestaShop to WooCommerce through 4.44.3, FG Drupal to WordPress through 3.67.0, and FG Joomla to WordPress through 4.15.0. CVSS 3.1 is 4.3: network reachable, low complexity, no privileges required, user interaction required, unchanged scope, low availability impact.
Likely exposure
Exposure is limited to WordPress sites with one of the named migration plugins installed at the affected versions. These plugins are often used during migrations, so stale installed copies on production WordPress sites are a realistic inventory concern.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The CVSS vector indicates exploitation requires user interaction, consistent with CSRF. The record does not provide exploit mechanics, proof-of-concept status, or confirmed real-world abuse.
Researcher notes
Evidence is sparse beyond CVE metadata and Patchstack database entries. The affected version ceilings are clear, but the bundle does not name fixed versions, vulnerable endpoints, exploit availability, or vendor remediation details. Avoid assuming active exploitation.
Mitigation direction
- Inventory WordPress sites for the three named FG migration plugins.
- Compare installed versions against the affected version ceilings in the CVE record.
- Check vendor or Patchstack guidance for patched versions or official mitigations.
- Remove disabled or unused migration plugins from production sites.
- Limit administrative access to trusted users while remediation is pending.
Validation and detection
- Confirm plugin slugs and versions from WordPress inventory or asset management.
- Verify whether affected plugins remain active on internet-facing WordPress sites.
- Review Patchstack entries for any available remediation status updates.
- Document whether each site is affected, not installed, upgraded, or removed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-24837 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/vulnerability/fg-drupal-to-wp/wordpress-fg-drupal-to-wordpress-plugin-3-67-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cveCVE reference · vdb-entry
- https://patchstack.com/database/vulnerability/fg-prestashop-to-woocommerce/wordpress-fg-prestashop-to-woocommerce-plugin-4-44-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cveCVE reference · vdb-entry
- https://patchstack.com/database/vulnerability/fg-joomla-to-wordpress/wordpress-fg-joomla-to-wordpress-plugin-4-15-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cveCVE reference · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.