CVE-2024-32789: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the Seers WordPress plugin (GDPR & CCPA Cookie Consent & Compliance) affecting versions up to 8.1.0. The vulnerability was reported on December 10, 2023, by security researcher Le Ngoc Anh and was publicly disclosed on April 22, 2024. The issue was assigned CVE-2024-32789 (Patchstack).

The vulnerability stems from missing or incorrect nonce validation on several functions within the plugin. The severity of this vulnerability has been assessed with a CVSS v3.1 score of 7.1 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (WPScan, Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. Additionally, it enables attackers to perform unauthorized actions, including the potential injection of malicious scripts via forged requests, provided they can trick a site administrator into performing specific actions such as clicking on a malicious link (WPScan).

The vulnerability requires user interaction and can be exploited by unauthenticated attackers. The attack vector is network-accessible, with low attack complexity, requiring no privileges but necessitating user interaction (Patchstack).

The vulnerability has been fixed in version 8.1.1 of the Seers plugin. Users are advised to update to this version or later to remove the vulnerability. The security issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).