CVE-2024-24702: 
WordPress vulnerability analysis and mitigation

The Page Restrict WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2024-24702. The vulnerability affects all versions of the plugin up to and including version 2.5.5, and was discovered by researcher 'emad'. The issue was publicly disclosed on January 31, 2024 (Patchstack, WPScan).

The vulnerability stems from missing or incorrect nonce validation in the 'pr_admin_page' function. The severity is rated as Low with a CVSS score of 4.3. The issue falls under the OWASP Top 10 category A1: Broken Access Control and is classified as CWE-352 (WPScan).

This vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The attack can be initiated by unauthenticated attackers who can modify the plugin's settings through forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (Patchstack, WPScan).

The vulnerability can be exploited by unauthenticated users, though it requires user interaction from an authenticated administrator. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects version 2.5.5 and earlier versions of the Page Restrict plugin (Patchstack).