CVE-2021-24668: 
WordPress vulnerability analysis and mitigation

The MAZ Loader WordPress plugin versions before 1.4.1 contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2021-24668. The vulnerability was discovered and publicly disclosed on October 25, 2021. The issue affects the plugin's loader deletion functionality, which lacks proper security controls (WPScan).

The vulnerability stems from the absence of nonce checks in the plugin's functionality. This security weakness is classified as CWE-352 (Cross-Site Request Forgery) and has been assigned a CVSS score of 4.3 (Medium). The vulnerability specifically affects the loader deletion functionality in the plugin's admin interface (WPScan).

When exploited, this vulnerability allows attackers to trick administrators into deleting arbitrary loaders from the MAZ Loader plugin without their knowledge or consent. This can lead to unauthorized removal of loader configurations and potential disruption of website functionality (WPScan).

The vulnerability was fixed in version 1.4.1 of the MAZ Loader plugin. The vendor was initially notified on August 24th, 2021, and the issue was escalated to the WordPress plugins team multiple times. Despite two new versions being released, the fix was delayed (WPScan).