CVE-2024-13336: 
WordPress vulnerability analysis and mitigation

The Disable Auto Updates plugin for WordPress (version <= 1.4) contains a Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2024-13336. The vulnerability was discovered and publicly disclosed on February 18, 2025, with the last update to the advisory on February 19, 2025. As a result of this security issue, the plugin has been temporarily closed and is not available for download pending a full security review (Wordfence Intel, WordPress Plugin).

The vulnerability has been classified with a CVSS score of 4.3 (Medium) and is categorized under CWE-352, which pertains to Cross-Site Request Forgery. The plugin was compatible with WordPress version 4.0 or higher and was tested up to version 6.6.2 (Wordfence Intel, NVD CNA).

A successful exploitation of this CSRF vulnerability could potentially allow attackers to manipulate the auto-update settings of the WordPress installation without proper authorization (Wordfence Intel).

The WordPress plugin repository has temporarily closed the plugin as of February 18, 2025, pending a full security review. Users are advised to seek alternative solutions for managing WordPress auto-updates until the security review is complete (WordPress Plugin).