CVE-2024-22140: 
WordPress vulnerability analysis and mitigation

Cross-Site Request Forgery (CSRF) vulnerability was discovered in Cozmoslabs Profile Builder Pro, affecting versions through 3.10.0. The vulnerability was identified on January 31, 2024, and received a high severity CVSS v3.1 base score of 8.8 (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and received a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

The CSRF vulnerability could potentially lead to account takeover, allowing malicious actors to force higher privileged users to execute unwanted actions under their current authentication (Patchstack).

The vulnerability requires user interaction for successful exploitation, though it can be initiated by an unauthenticated attacker. The high CVSS score of 8.8 indicates that the vulnerability is relatively easy to exploit once the conditions are met (Patchstack).

The vulnerability has been fixed in version 3.10.1 of Profile Builder Pro. Users are advised to update to version 3.10.1 or later to remove the vulnerability (Patchstack).