CVE-2024-27968: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Optimole Super Page Cache for Cloudflare WordPress plugin, affecting versions up to and including 4.7.5. The vulnerability was discovered by Majed Refaea and publicly disclosed on March 13, 2024. This security issue allows for Stored Cross-Site Scripting (XSS) attacks through CSRF (Patchstack).

The vulnerability stems from missing or incorrect nonce validation in the admin_menu_page_index() function. The issue has been assigned CVE-2024-27968 and received a CVSS v3.1 base score of 7.1 (High) from Patchstack, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The NVD has assigned a slightly lower CVSS score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD, WPScan).

The vulnerability allows unauthenticated attackers to update the plugin's settings via forged requests if they can trick a site administrator into performing specific actions, such as clicking on a malicious link. This can lead to stored XSS attacks, potentially compromising the security of the affected WordPress installation (WPScan).

The vulnerability requires user interaction and can be exploited by unauthenticated attackers. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N), though it does need user interaction (UI:R) (Patchstack).

The vulnerability has been fixed in version 4.7.6 of the Super Page Cache for Cloudflare plugin. Site administrators are strongly advised to update to this version or later to resolve the security issue (WPScan).