Vulnerability details

CVE-2024-6719

Offload Videos

Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF

CVSS 3.1

8.1High

Official description

The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack

CVSS scores

Score	Version	Source	Vector
8.1High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
—	Offload Videos	v < 1.0.1	CVEProject cvelistV5 (CNA)

References and advisories

https://wpscan.com/vulnerability/1dc7caac-a36e-4313-a8be-c6b13e564924/ exploitvdb-entrytechnical-description

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-05-15
Last updated: 2025-05-20
State: Published
Assigner (CNA): WPScan

Exploit prediction (EPSS)

0.23%

Probability of exploitation in 30 days

14.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial