CVE-2024-11415: 
WordPress vulnerability analysis and mitigation

The WP-Orphanage Extended plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.2. The vulnerability was disclosed on November 22, 2024, and has been assigned CVE-2024-11415. The issue stems from missing or incorrect nonce validation in the wporphanageexmenusettings() function (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The technical root cause is identified as CWE-352: Cross-Site Request Forgery (CSRF). The vulnerability exists in the wporphanageexmenusettings() function due to improper implementation of nonce validation (Wordfence).

If successfully exploited, this vulnerability allows unauthenticated attackers to escalate the privileges of all orphan accounts through a forged request, provided they can trick a site administrator into performing an action such as clicking on a malicious link (NVD).

Users of the WP-Orphanage Extended plugin should update to a version newer than 1.2 if available. As this is a recently disclosed vulnerability, website administrators should monitor for updates from the plugin developers and implement them as soon as they become available (NVD).