CVE-2024-2960: 
WordPress vulnerability analysis and mitigation

The SVS Pricing Tables plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-2960) affecting all versions up to and including 1.0.4. The vulnerability was discovered and publicly disclosed on April 29, 2024, with a CVSS v3.1 base score of 4.3 (Medium) (NVD, Wordfence).

The vulnerability stems from missing or incorrect nonce validation in the deletePricingTable() function. This security flaw has been assigned a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required for exploitation (NVD).

When exploited, the vulnerability allows unauthenticated attackers to delete pricing tables from the affected WordPress installation through forged requests. The impact is limited to the integrity of pricing table data, requiring user interaction for successful exploitation (NVD).

The vulnerability can be exploited by crafting a malicious request that triggers the deletion of pricing tables. Successful exploitation requires social engineering to trick a site administrator into performing specific actions, such as clicking on a specially crafted link (NVD).

Website administrators running the SVS Pricing Tables plugin should update to a version newer than 1.0.4 if available. In the absence of an update, it is recommended to implement additional security measures such as web application firewalls and to exercise caution when clicking on links while logged into the WordPress admin panel (NVD).