CVE-2024-32699: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in YITH WooCommerce Compare plugin versions through 2.37.0. The vulnerability was reported on March 13, 2024, by Ngô Thiên An from VNPT-VCI and was publicly disclosed on April 22, 2024 (Patchstack).

The vulnerability is classified as Cross-Site Request Forgery (CSRF) with a CVSS v3.1 base score of 4.3 (Medium), and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is tracked as CWE-352 and requires no authentication to exploit (Patchstack).

This vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The severity is considered low, with potential impact limited to integrity (Patchstack).

The vulnerability requires user interaction and has a low complexity of exploitation. No authentication is required to exploit this vulnerability, though it is considered unlikely to be exploited due to its low severity impact (Patchstack).

The vulnerability has been fixed in version 2.38.0 of the YITH WooCommerce Compare plugin. Users are advised to update to version 2.38.0 or later to remove the vulnerability (Patchstack).