CVE-2024-11342: 
WordPress vulnerability analysis and mitigation

The Skt NURCaptcha plugin for WordPress (CVE-2024-11342) contains a Cross-Site Request Forgery vulnerability affecting all versions up to and including 3.5.0. The vulnerability was disclosed on November 25, 2024, and primarily affects WordPress installations using this plugin (NVD CVE).

The vulnerability stems from missing or incorrect nonce validation in the skt-nurc-admin.php file. The issue has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) (NVD CVE, Wordfence Report).

The vulnerability allows unauthenticated attackers to update settings and inject malicious web scripts through forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (NVD CVE).

The vulnerability requires user interaction (such as clicking a link) and can be exploited by unauthenticated attackers remotely. The attack complexity is considered low, making it relatively straightforward to exploit once the social engineering aspect is successful (Wordfence Report).

Website administrators running the Skt NURCaptcha plugin should update to a version newer than 3.5.0 if available. If an update is not possible, considering disabling or removing the plugin until a patch is available (NVD CVE).