CVE-2024-35657: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WP-Recall WordPress plugin, affecting versions up to and including 16.26.6. The vulnerability was identified on June 3, 2024, and was assigned CVE-2024-35657. The issue affects the plugin developed by Plechev Andrey (Patchstack, WPScan).

The vulnerability stems from missing or incorrect nonce validation on a function within the WP-Recall plugin. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (Patchstack).

This vulnerability allows unauthenticated attackers to perform unauthorized actions by tricking site administrators into performing specific actions, such as clicking on malicious links. The impact primarily affects the integrity and availability of the system, as indicated by the CVSS scoring (WPScan).

The vulnerability requires user interaction (UI:R in CVSS score) but can be exploited remotely without authentication. The attack complexity is considered low (AC:L), making it relatively straightforward to exploit if the conditions are met (Patchstack).

The vulnerability has been patched in version 16.26.7 of the WP-Recall plugin. Users are advised to update to this version or later to remediate the security issue (WPScan).