CVE-2024-12386: 
WordPress vulnerability analysis and mitigation

The WP Abstracts plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 2.7.3. The vulnerability was discovered in February 2025 and assigned identifier CVE-2024-12386 (NVD).

The vulnerability stems from missing nonce validation on multiple functions within the plugin. This security flaw received a CVSS v3.1 base score of 5.4 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, while Wordfence assessed it at 8.1 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H (NVD).

The vulnerability allows unauthenticated attackers to delete arbitrary accounts through forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (NVD).

The vulnerability requires user interaction, specifically requiring an administrator to be tricked into clicking a malicious link. No public exploits have been reported in the wild at the time of assessment (NVD).

The vulnerability has been patched in version 2.7.4 of the WP Abstracts plugin. The update implements best practices to protect against Cross-Site Request Forgery vulnerability. Site administrators are advised to update to the latest version immediately (WordPress Plugin).