Cyber Resilience

CVE-2024-37451

Medium

Published: 02 January 2025

Published
02 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0017 38.2th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37451 is a medium-severity CSRF (CWE-352) vulnerability in Rarathemes Travel Agency. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-37451 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Travel Agency WordPress theme developed by Rara Theme. This issue affects the Travel Agency theme from unknown initial versions through version 1.4.9.

The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Attackers can exploit it remotely over the network with low attack complexity and no required privileges, though it demands user interaction, such as visiting a malicious site. Exploitation enables low-impact integrity modifications, allowing unauthorized actions to be performed on behalf of authenticated users who interact with forged requests.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/travel-agency/vulnerability/wordpress-travel-agency-theme-1-4-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve documents the CSRF vulnerability in Travel Agency theme version 1.4.9 and provides details for mitigation.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in raratheme Travel Agency travel-agency allows Cross Site Request Forgery.This issue affects Travel Agency: from n/a through <= 1.4.9.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF in public-facing WordPress theme directly enables remote exploitation of the web application without authentication.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-37450Same vendor: Rarathemes
CVE-2024-37503Same vendor: Rarathemes
CVE-2024-37508Same vendor: Rarathemes
CVE-2024-37435Same vendor: Rarathemes
CVE-2024-37937Same vendor: Rarathemes
CVE-2024-37102Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352

Affected Assets

rarathemes
travel agency
≤ 1.5.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Remediating the specific CSRF flaw in the Travel Agency WordPress theme directly prevents exploitation of CVE-2024-37451.

SC-23 Session Authenticity good match
prevent

Session authenticity mechanisms, such as anti-CSRF tokens, directly protect against forged requests that exploit CVE-2024-37451 on behalf of authenticated users.

SI-10 Information Input Validation good match
prevent

Validating inputs like CSRF tokens at entry points prevents processing of malicious forged requests targeting CVE-2024-37451.

References