CVE-2024-34439: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in divSpot DS Site Message WordPress plugin, affecting versions through 1.14.4. The vulnerability was reported on March 31, 2024, and publicly disclosed on May 7, 2024 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (Patchstack).

This vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability can be exploited by unauthenticated users, though it requires user interaction. The attack vector is network-accessible with low attack complexity (Patchstack).

The vulnerability has been patched in version 1.14.5 of the DS Site Message plugin. Users are advised to update to this version or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users update to a fixed version (Patchstack).