CVE-2024-10711: 
WordPress vulnerability analysis and mitigation

The WooCommerce Report plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.5.1. The vulnerability was discovered and disclosed in November 2024, impacting websites using the WooCommerce Report plugin developed by ithemelandco (NVD).

The vulnerability stems from missing or incorrect nonce validation in the settings update functionality. This security flaw has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is tracked as CVE-2024-10711 and is classified under CWE-352 (Cross-Site Request Forgery) (NVD, Wordfence).

The vulnerability allows unauthenticated attackers to update arbitrary options that can be leveraged for privilege escalation. This is possible when attackers can trick a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

The vulnerability has been patched in version 1.5.2 of the WooCommerce Report plugin. Users are strongly advised to update to this version or later to protect against potential attacks (WordPress Plugin).