CVE-2024-31354: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress Slideshow Gallery LITE plugin, affecting versions up to 1.7.8. The vulnerability was reported on March 6, 2024, by security researcher Ananda Dhakal and was assigned CVE-2024-31354. The issue was publicly disclosed on April 7, 2024 (Patchstack).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, identified as CWE-352. It received a CVSS v3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability can be exploited without authentication, though it requires user interaction (Patchstack).

This vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered low priority, and the impact is unlikely to cause significant damage to affected systems (Patchstack).

The vulnerability requires no authentication to exploit, though it does need user interaction. It falls under the OWASP Top 10 category of A1: Broken Access Control (Patchstack).

The vulnerability has been fixed in version 1.7.9 of the Slideshow Gallery plugin. Users are advised to update to version 1.7.9 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).