CVE-2024-2376 is a high severity (8.8) cross-site request forgery flaw in the WPQA Builder WordPress plugin before 6.1.1. Update to 6.1.1 or later. If you cannot update now, deactivate the plugin. NVD published it on 2024-07-03. CISA does not list it as exploited.
Weakness: CWE-352 (Cross-Site Request Forgery).
What's affected
- Affected: WPQA Builder WordPress plugin, all versions before 6.1.1.
- Fixed: 6.1.1, per the record's description.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, network reachable, no privileges, and a logged-in user must be tricked into a request.
The record, which comes from WPScan, says CSRF checks are missing in some places, so an attacker can make logged-in users perform unwanted actions. It does not list which actions.
How to check if you're exposed
- In the WordPress admin, open Plugins and read the WPQA Builder version.
- With WP-CLI, run
wp plugin list --name=wpqa-builder --fields=name,version,status. The slug is an assumption, so runwp plugin listif nothing prints. - Check the WPScan entry for the exact slug and any further notes.
What to do now
- Update WPQA Builder to 6.1.1 or later from the WordPress admin or with
wp plugin update. - If an update is not possible today, deactivate the plugin.
- Ask administrators to sign out of WordPress when browsing other sites, and use separate browser profiles for admin work.
- Review recent changes made by privileged users for anything unexpected.
- Enable automatic plugin updates for plugins you trust.
- Add the plugin and its version to your site inventory so the next advisory is quick to match.
Why it matters
The record classes this as CWE-352 (Cross-Site Request Forgery). WordPress protects state changing requests with a nonce, a one time token tied to the user. When a plugin skips that check, a hostile page can submit the request using the victim's logged-in session. The score is high because the vector rates confidentiality, integrity and availability impact as high, which suggests the missing checks cover powerful actions, but the record does not say which.
The KEV flag is false. The record is a short WPScan entry, so it names no researcher, no specific actions and no exploit details, and we add none. NVD published it on 2024-07-03.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-2376?
WPQA Builder 6.1.1, per the record.
Do visitors need to be logged in?
The victim must be a logged-in user, since the attack rides on their session.
Sources
- CVE-2024-2376 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2376, as held in the batch record
- WPScan entry
Last reviewed: 19 October 2026.
