CVE-2024-32107: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in XLPlugins Finale Lite, a WordPress plugin for WooCommerce sales countdown and discount functionality. The vulnerability affects versions up to 2.18.0 and was initially reported on January 16, 2024, with public disclosure on April 11, 2024. The vulnerability was assigned identifier CVE-2024-32107 (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This scoring indicates that the vulnerability requires no privileges (unauthenticated) but does need user interaction to be exploited (Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered low, with potential impact primarily affecting the integrity of the system through unauthorized state changes (Patchstack).

The vulnerability requires user interaction to be exploited and is classified as having low complexity for exploitation. However, it has been assessed as unlikely to be exploited due to its low severity impact (Patchstack).

The vulnerability has been fixed in version 2.18.1 of the Finale Lite plugin. Users are recommended to update to version 2.18.1 or later to remove the vulnerability. Patchstack users have the additional option to enable auto-update for vulnerable plugins (Patchstack).