CVE-2023-46618: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was identified in the Category SEO Meta Tags WordPress plugin, versions 2.5 and below, developed by Bala Krishna and Sergey Yakovlev. The vulnerability was reported on April 30, 2023, and publicly disclosed on October 25, 2023 (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). It received varying CVSS scores, with NIST assigning a high severity score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while Patchstack rated it as medium severity with a score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) (NVD).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The attack requires user interaction but does not need authentication to exploit (Patchstack).

As of the disclosure date, no official fix has been made available for this vulnerability. The issue was initially reported by researcher LEE SE HYOUNG (hackintoanetwork), and early warning was sent to Patchstack customers (Patchstack).