CVE-2021-24641: 
WordPress vulnerability analysis and mitigation

The Images to WebP WordPress plugin versions before 1.9 were found to contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities, identified as CVE-2021-24641. The vulnerability was discovered by researcher apple502j and was publicly disclosed on October 19, 2021. This security issue affects the administrative functions of the Images to WebP WordPress plugin (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms in certain administrative actions within the plugin. The issue is classified under CWE-352 and has been assigned a CVSS score of 5.4 (medium severity). The vulnerability falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

When exploited, this vulnerability could lead to multiple adverse effects including unauthorized modification of plugin settings, potential Denial-of-Service conditions, and arbitrary image conversion. Additionally, attackers could manipulate the website's .htaccess file through specially crafted requests (WPScan).

The vulnerability has been fixed in version 1.9 of the Images to WebP plugin. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).