CVE-2024-12605: 
WordPress vulnerability analysis and mitigation

The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 2.3. The vulnerability was discovered and reported on January 9, 2025 (NVD).

The vulnerability stems from missing or incorrect nonce validation on the 'al_scribe_content_data' actions. The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The weakness has been classified as CWE-352: Cross-Site Request Forgery (CSRF) (NVD, Wordfence).

This vulnerability allows unauthenticated attackers to update plugin settings via a forged request if they can trick a site administrator into performing an action such as clicking on a malicious link (NVD).

The vulnerability requires user interaction (UI:R in CVSS score) where an attacker needs to trick a site administrator into clicking a malicious link. No authentication (PR:N) is required to exploit this vulnerability, and it can be executed over the network (AV:N) (NVD).

Users should upgrade to a version newer than 2.3 of the AI Scribe WordPress plugin once available. Until then, site administrators should be cautious of clicking on unknown links while logged into their WordPress dashboard (NVD).