CVE-2024-1315: 
WordPress vulnerability analysis and mitigation

The Classified Listing – Classified ads & Business Directory Plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 3.0.4. The vulnerability was discovered in the 'rtcl_update_user_account' function due to missing or incorrect nonce validation (NVD).

The vulnerability exists due to missing or incorrect nonce validation in the 'rtcl_update_user_account' function. This security flaw allows unauthenticated attackers to change administrator user's password and email address through a forged request, provided they can trick a site administrator into performing an action such as clicking on a link. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

The successful exploitation of this vulnerability allows attackers to lock administrators out of their sites and prevent them from resetting their passwords, while simultaneously granting the attacker access to the administrator account (NVD).

The vulnerability requires user interaction to exploit, specifically requiring a site administrator to be tricked into performing an action such as clicking on a malicious link. The attack can be executed by unauthenticated attackers remotely (NVD).

The vulnerability has been patched in version 3.0.5 of the Classified Listing plugin. Users are advised to update to this version or later to protect against this security issue (NVD).