CVE-2024-0379: 
WordPress vulnerability analysis and mitigation

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-0379) affecting all versions up to and including 2.2.1. The vulnerability was discovered and disclosed on February 28, 2024, and affects the WordPress plugin developed by Smash Balloon (NVD).

The vulnerability stems from missing or incorrect nonce validation in the ctf_auto_save_tokens function. The CVSS v3.1 base score is 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (NVD).

When exploited, this vulnerability allows unauthenticated attackers to update the site's Twitter API token and secret through a forged request, provided they can trick a site administrator into performing an action such as clicking on a malicious link (NVD).

The vulnerability requires user interaction (UI:R in CVSS score) where an attacker needs to trick a site administrator into clicking a malicious link. No authentication is required (PR:N), and the attack can be launched from the network (AV:N) with low attack complexity (AC:L) (NVD).

Users should update their Custom Twitter Feeds plugin to version 2.2.2 or later, which includes plugin hardening fixes. The update was released on February 6, 2024, as part of the plugin's security improvements (WordPress Plugin).