CVE-2024-22304: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was identified in Borbis Media's FreshMail For WordPress plugin, affecting versions up to and including 2.3.2. The vulnerability was discovered by researcher Skalucy and was publicly disclosed on January 17, 2024 (Patchstack, WPScan).

The vulnerability stems from missing nonce validation function in the FreshMail For WordPress plugin. The severity of this vulnerability has been assessed with varying CVSS scores: NIST assigned a high severity score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while Patchstack rated it as medium severity with a score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L). The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

The vulnerability allows unauthenticated attackers to perform unauthorized actions by tricking site administrators into performing specific actions, such as clicking on malicious links. This could lead to unauthorized changes in the system when exploited successfully (WPScan).

Currently, there is no official fix available for this vulnerability. The security issue has been assessed as having a low priority for virtual patching (Patchstack).