CVE-2024-31378: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the MailChimp Forms by MailMunch WordPress plugin, affecting versions up to and including 3.2.1. The vulnerability was identified on April 10, 2024, and was assigned CVE-2024-31378. The issue stems from missing or incorrect nonce validation on the integrate case (WPScan, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, while Patchstack assessed it with a score of 5.4 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

The vulnerability allows unauthenticated attackers to update the plugin's access token via a forged request if they can trick a site administrator into performing specific actions, such as clicking on a malicious link (WPScan).

The vulnerability requires user interaction to be exploited, specifically requiring an administrator to be tricked into performing certain actions. The attack can be executed by an unauthenticated attacker from a network vector (Patchstack).

The vulnerability has been fixed in version 3.2.2 of the MailChimp Forms by MailMunch plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).