Cyber Resilience

CVE-2024-39623

High

Published: 02 January 2025

Published
02 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-39623 is a high-severity CSRF (CWE-352) vulnerability in Cridio Listingpro. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-39623 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, in the CridioStudio ListingPro WordPress theme. This issue affects ListingPro versions from n/a through 2.9.4 and allows authentication bypass. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, no required privileges, and high impacts across confidentiality, integrity, and availability.

Attackers can exploit this vulnerability remotely without authentication by tricking authenticated users into interacting with a malicious site or resource, such as clicking a crafted link. This user interaction enables the CSRF attack, resulting in authentication bypass and potential account takeover.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-3-cross-site-request-forgery-csrf-to-account-takeover-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro listingpro allows Authentication Bypass.This issue affects ListingPro: from n/a through <= 2.9.4.

CWE(s)
CWE-352

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CSRF vulnerability in public-facing WordPress theme directly enables remote exploitation for authentication bypass/account takeover without credentials.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-37102Shared CWE-352
CVE-2024-37450Shared CWE-352
CVE-2025-23558Shared CWE-352
CVE-2025-68722Shared CWE-352
CVE-2025-31440Shared CWE-352
CVE-2025-23848Shared CWE-352
CVE-2025-22571Shared CWE-352
CVE-2024-53684Shared CWE-352
CVE-2025-23455Shared CWE-352
CVE-2025-22582Shared CWE-352

Affected Assets

cridio
listingpro
≤ 2.9.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match
prevent

SC-23 requires mechanisms like anti-CSRF tokens or cryptographic hashes to protect session authenticity, directly preventing forged requests that exploit this CSRF vulnerability for authentication bypass.

SI-10 Information Input Validation good match
prevent

SI-10 mandates validation of information inputs, including CSRF tokens in ListingPro forms, to block malicious cross-site requests leading to account takeover.

SI-2 Flaw Remediation good match
preventrecover

SI-2 ensures timely identification, reporting, and correction of the specific CSRF flaw in ListingPro versions through 2.9.4, eliminating the authentication bypass vulnerability.

References