Cyber Resilience

CVE-2024-37503

Medium

Published: 02 January 2025

Published
02 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0018 39.2th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37503 is a medium-severity CSRF (CWE-352) vulnerability in Rarathemes Lawyer Landing Page. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-37503 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the Lawyer Landing Page WordPress theme by Raratheme. The issue affects the theme from unknown initial versions through 1.2.4 and was published on 2025-01-02.

The vulnerability carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Attackers can exploit it remotely over the network with low attack complexity and no required privileges, though it demands user interaction, such as a victim clicking a malicious link while authenticated to the site. Exploitation enables low-impact integrity effects, allowing unauthorized actions to be performed on the victim's behalf.

Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/lawyer-landing-page/vulnerability/wordpress-lawyer-landing-page-theme-1-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Cross Site Request Forgery.This issue affects Lawyer Landing Page: from n/a through <= 1.2.4.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF in public-facing WordPress theme directly enables exploitation of a web application vulnerability (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-37450Same vendor: Rarathemes
CVE-2024-37508Same vendor: Rarathemes
CVE-2024-37451Same vendor: Rarathemes
CVE-2024-37435Same vendor: Rarathemes
CVE-2024-37937Same vendor: Rarathemes
CVE-2024-37102Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352

Affected Assets

rarathemes
lawyer landing page
≤ 1.2.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 requires protections for the authenticity of communications sessions, directly countering CSRF attacks that forge requests on behalf of authenticated users in the Lawyer Landing Page theme.

SI-10 Information Input Validation good match
prevent

SI-10 mandates validation of information inputs, enabling checks for anti-CSRF tokens to block forged requests exploiting this vulnerability.

SI-2 Flaw Remediation good match
prevent

SI-2 ensures timely identification, reporting, and remediation of flaws, directly addressing this CSRF vulnerability by patching the affected Lawyer Landing Page theme versions <=1.2.4.

References