CVE-2024-13753
Published: 20 February 2025
Summary
CVE-2024-13753 is a high-severity CSRF (CWE-352) vulnerability in Webcodingplace Ultimate Classified Listings. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13753 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the Ultimate Classified Listings plugin for WordPress in all versions up to and including 1.5. The issue arises from missing or incorrect nonce validation in the update_profile function, enabling forged requests to alter user data.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no privileges required, though user interaction is needed, as reflected in its CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). By tricking a victim into actions like clicking a malicious link, attackers can modify the victim's email address via a forged request, potentially leading to account takeover.
Plugin references include source code from version 1.4 and a changeset comparing versions 1.5 and 1.6, indicating that the vulnerability was addressed in version 1.6. Wordfence's threat intelligence page provides further details on the issue, recommending updates to patched versions for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4615
Vulnerability details
The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the update_profile function. This makes it possible for unauthenticated…
more
attackers to modify victim's email via a forged request, which might lead to account takeover, granted they can trick a user into performing an action such as clicking on a link.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF in public-facing WordPress plugin directly enables T1190 exploitation; requires malicious link click for user interaction (T1204.001) leading to profile/email modification and account takeover.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires mechanisms like nonce validation to protect session authenticity against CSRF attacks that forge requests to modify user profile data such as email addresses.
Mandates timely identification, reporting, and patching of flaws like the missing nonce validation in the Ultimate Classified Listings plugin up to version 1.5.
Enforces validation of information inputs, including CSRF tokens in the update_profile function, to block forged requests from altering victim email addresses.