CVE-2024-34367: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Popup Box Team's Popup box WordPress plugin, affecting versions up to 4.1.2. The vulnerability was reported on January 25, 2024, by security researcher Steven Julian and was officially published on May 3, 2024, with CVE-2024-34367 assigned (Patchstack).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) that can lead to Cross-Site Scripting (XSS). It received a CVSS v3.1 score of 7.1 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked under CWE-352 (Cross-Site Request Forgery) (NVD).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The impact is considered to have low severity but affects confidentiality, integrity, and availability of the system (Patchstack).

The vulnerability can be exploited by an unauthenticated attacker and requires user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Patchstack).

The vulnerability has been fixed in version 4.1.3 of the Popup Box plugin. Users are advised to update to this version or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).