Cyber Resilience

CVE-2024-32104

Medium

Published: 15 April 2024

Published
15 April 2024
Modified
28 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.1513 94.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-32104 is a medium-severity CSRF (CWE-352) vulnerability in Xlplugins Nextmove. Its CVSS base score is 4.3 (Medium).

Operationally, ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability CVE-2024-32104 is a Cross-Site Request Forgery (CSRF) flaw, tracked as CWE-352, in the XLPlugins NextMove Lite WordPress plugin. It affects all versions through 2.18.1 and received a CVSS v3.1 score of 4.3, reflecting network attack vector, low complexity, no required privileges, and required user interaction that results in limited integrity impact without affecting confidentiality or availability.

An unauthenticated attacker can exploit the issue by crafting a malicious request that an authenticated user is tricked into submitting, enabling unauthorized actions such as configuration changes within the affected plugin instance.

Public advisories published via Patchstack document the vulnerability in the woo-thank-you-page-nextmove-lite component and point to available remediation steps for the affected plugin versions. The associated EPSS score has remained flat at 0.1513 with no material increase observed since disclosure.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.18.1.

CWE(s)
CWE-352

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

xlplugins
nextmove
≤ 2.18.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AT-2 Literacy Training and Awareness
addresses: CWE-352

Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.

IA-11 Re-authentication
addresses: CWE-352

Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.

PM-14 Testing, Training, and Monitoring
addresses: CWE-352

Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.

SI-4 System Monitoring
addresses: CWE-352

Detects anomalous request patterns consistent with cross-site request forgery.

References