CVE-2024-31369: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in PenciDesign's Soledad WordPress theme, affecting versions up to 8.4.2. The vulnerability was reported by Rafie Muhammad and was officially assigned CVE-2024-31369 on April 9, 2024 (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) with a CVSS v3.1 base score of 5.4 (Medium). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, indicating that the vulnerability is network accessible, requires low attack complexity, needs no privileges, but does require user interaction (Patchstack).

This vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered low to medium, with potential impacts on integrity and availability of the affected system (Patchstack).

The vulnerability is classified as having low attack complexity and requires no privileges to exploit, though user interaction is necessary. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 8.4.6 of the Soledad theme. Users are advised to update to version 8.4.6 or later to remove the vulnerability (Patchstack).