CVE-2024-1755: 
WordPress vulnerability analysis and mitigation

The NPS computy WordPress plugin through version 2.7.5 contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2024-1755. The vulnerability was discovered by Bob Matyas and publicly disclosed on March 25, 2024. This security issue affects the plugin's functionality where certain operations lack proper CSRF protection mechanisms (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, receiving a CVSS score of 4.3 (medium severity). It is categorized under OWASP Top 10 as A2: Broken Authentication and Session Management and corresponds to CWE-352. The technical issue stems from the absence of CSRF checks in specific plugin functionalities, which could enable attackers to execute unauthorized actions through CSRF attacks (WPScan).

When exploited, this vulnerability allows attackers to manipulate logged-in administrators into performing unwanted actions without their knowledge or consent. Specifically, the vulnerability can be leveraged to delete all existing poll responses in the system (WPScan).

The vulnerability requires an attacker to craft a specific CSRF payload and trick an authenticated administrator into accessing it. A proof of concept exists demonstrating how an attacker can exploit this vulnerability to delete all poll responses when a logged-in administrator accesses a specially crafted URL (WPScan).

The vulnerability has been patched in version 2.7.6 of the NPS computy WordPress plugin. Users are advised to update their installations to this latest version to mitigate the risk (WPScan).