CVE-2024-11812: 
WordPress vulnerability analysis and mitigation

The Wtyczka SeoPilot dla WP plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 3.3.091, discovered and disclosed on December 20, 2024. The vulnerability exists in the SeoPilot_Admin_Options() function due to missing or incorrect nonce validation (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue stems from improper security controls in the SeoPilot_Admin_Options() function, specifically the lack of proper nonce validation. This vulnerability is classified as CWE-352: Cross-Site Request Forgery (NVD).

If exploited, this vulnerability allows unauthenticated attackers to update settings and inject malicious web scripts through forged requests. The attack requires social engineering to trick a site administrator into performing specific actions, such as clicking on a malicious link (NVD).

The vulnerability requires user interaction and can be exploited by unauthenticated attackers. The attack vector is network-accessible and has low attack complexity, though it requires convincing an administrator to perform specific actions (NVD).

Users should update to a version newer than 3.3.091 when available. The vulnerability can be exploited by unauthenticated attackers if they can trick a site administrator into performing specific actions (NVD).