CVE-2024-1230: 
WordPress vulnerability analysis and mitigation

The SimpleShop plugin for WordPress versions up to 2.10.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2024-1230. The vulnerability was discovered by Francesco Carlucci and was publicly disclosed on May 3, 2024 (Wordfence).

The vulnerability exists in the disconnect feature of the SimpleShop plugin where the application failed to implement proper CSRF protection. The issue was specifically located in the Settings.php file where the disconnect functionality lacked nonce verification for the disconnect_simpleshop action (GitHub Commit). The vulnerability has been assigned a CVSS score of 4.3 (Medium) (Wordfence).

If exploited, this CSRF vulnerability could allow an attacker to trick authenticated administrators into disconnecting their SimpleShop integration without their knowledge or consent, potentially disrupting e-commerce operations on the affected WordPress sites (GitHub Commit).

The vulnerability requires an authenticated administrator to click on a maliciously crafted link while being logged into the WordPress admin panel. The attack vector involves social engineering to trick administrators into triggering the disconnect action (Wordfence).

The vulnerability has been patched in the plugin update by adding nonce verification to the disconnect feature. Site administrators are advised to update to the latest version of the SimpleShop plugin which includes proper CSRF protection through the implementation of WordPress nonce verification (GitHub Commit).