Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-37426: Elegant Pink theme permits forged web requests

CVE-2024-37426 · published 1 year ago

Summary

The Elegant Pink WordPress theme (versions up to 1.3.0) can be tricked into performing actions on behalf of a logged‑in user without their consent. This could let an attacker change settings or submit data without the user knowing. Update to the latest version of the theme or apply the vendor's patch to stop the unwanted request handling.

What to do

Update rarathemes elegant_pink to version 1.3.1 or later.

Affected software

Vendor	Product	Affected versions
rarathemes	elegant_pink	< 1.3.1 `cpe:2.3:a:rarathemes:elegant_pink::::::wordpress::*`

Original advisory text

Cross-Site Request Forgery (CSRF) vulnerability in raratheme Elegant Pink elegant-pink allows Cross Site Request Forgery.This issue affects Elegant Pink: from n/a through <= 1.3.0.

References

https://patchstack.com/database/wordpress/theme/elegant-pink/vulnerability/wordp... Third Party Advisory
https://patchstack.com/database/Wordpress/Theme/elegant-pink/vulnerability/wordp... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published2 Jan 2025

Updated26 Oct 2026

First seen7 Mar 2026

Sources

CVE-2024-37426 · NVD

Track software like this

Free during beta