CVE-2024-27194: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Andrei Ivasiuc's Fontific | Google Fonts WordPress plugin versions up to 0.1.6. The vulnerability was reported on January 5, 2024, and publicly disclosed on February 26, 2024 (Patchstack).

The vulnerability has been assigned CVE-2024-27194 and is classified as CWE-352 (Cross-Site Request Forgery). It received a CVSS v3.1 base score of 6.1 (MEDIUM) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a higher CVSS score of 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows an attacker to perform Stored Cross-Site Scripting (XSS) attacks through CSRF. This could enable malicious actors to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability can be exploited by an unauthenticated attacker and requires user interaction. The attacks are typically opportunistic and automated, targeting vulnerable websites before users have time to patch and update (Patchstack).

Currently, there is no official fix available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available (Patchstack).