CVE-2024-0830: 
WordPress vulnerability analysis and mitigation

The Comments Extra Fields For Post, Pages and CPT plugin for WordPress contains a Cross-Site Request Forgery vulnerability (CVE-2024-0830) affecting all versions up to and including 5.0. The vulnerability was disclosed on March 13, 2024, and was identified by Wordfence security researchers (NVD).

The vulnerability stems from missing or incorrect nonce validation on several ajax actions in the plugin. The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

If successfully exploited, attackers can modify comment form fields and update plugin settings through forged requests, potentially compromising the integrity of the WordPress site's comment system (NVD).

The vulnerability requires user interaction, as attackers need to trick a site administrator into performing an action such as clicking on a malicious link. The attack can be executed by unauthenticated attackers through forged requests (NVD).

Site administrators should update the Comments Extra Fields For Post, Pages and CPT plugin to a version newer than 5.0 if available. The vulnerability has been publicly disclosed and tracked in the WordPress plugin repository (WordPress Plugin).