CVE-2024-13879: 
WordPress vulnerability analysis and mitigation

The Stream plugin for WordPress versions up to 4.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows arbitrary options updates. The vulnerability was discovered by researcher Francesco Carlucci and disclosed on February 14, 2025 (Wordfence Threat Intel).

The vulnerability has a CVSS score of 8.8, indicating a high severity level. It affects the Stream plugin's options update functionality, allowing unauthorized changes to plugin settings through CSRF attacks (Wordfence Threat Intel).

If exploited, this vulnerability could allow attackers to modify Stream plugin settings without authorization through cross-site request forgery attacks (Wordfence Threat Intel).

The vulnerability requires an authenticated user to trigger the CSRF attack. No public exploits have been identified at the time of disclosure (Wordfence Threat Intel).

Users should update to Stream plugin version 4.1.0 or later which contains fixes for this vulnerability. The fix was released in January 2025 as documented in the changelog (Stream Changelog).