Cyber Resilience

CVE-2024-37508

Medium

Published: 02 January 2025

Published
02 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0018 38.8th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37508 is a medium-severity CSRF (CWE-352) vulnerability in Rarathemes Construction Landing Page. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-37508 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the Construction Landing Page WordPress theme developed by Rara Theme. This issue affects all versions of the theme from n/a through 1.3.5. The vulnerability has a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating medium severity with low integrity impact.

The vulnerability can be exploited over the network by any unauthenticated attacker with low attack complexity, provided they can trick an authenticated user into performing an action, such as visiting a malicious site or clicking a crafted link. Successful exploitation enables the attacker to perform unauthorized actions on the victim's behalf within the affected WordPress site, potentially leading to low-impact integrity violations like unintended state changes.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/construction-landing-page/vulnerability/wordpress-construction-landing-page-theme-1-3-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version of the Construction Landing Page theme beyond 1.3.5.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in raratheme Construction Landing Page construction-landing-page allows Cross Site Request Forgery.This issue affects Construction Landing Page: from n/a through <= 1.3.5.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF vulnerability in public-facing WordPress theme directly enables exploitation of the application by unauthenticated attackers via forged requests from authenticated users.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-37450Same vendor: Rarathemes
CVE-2024-37503Same vendor: Rarathemes
CVE-2024-37451Same vendor: Rarathemes
CVE-2024-37435Same vendor: Rarathemes
CVE-2024-37937Same vendor: Rarathemes
CVE-2024-37102Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352

Affected Assets

rarathemes
construction landing page
≤ 1.3.6

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires identification, reporting, and correction of system flaws, directly mitigating this CVE by mandating patching of the vulnerable Construction Landing Page WordPress theme.

SC-23 Session Authenticity good match
prevent

SC-23 enforces session authenticity mechanisms like anti-CSRF tokens, preventing attackers from forging requests on behalf of authenticated users in the affected theme.

SI-10 Information Input Validation good match
prevent

SI-10 mandates validation of information inputs, including CSRF tokens, to block unauthorized cross-site requests exploiting this vulnerability.

References