CVE-2024-35771: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress Customizr theme, affecting versions through 4.4.21. The vulnerability was identified on January 29, 2024, and publicly disclosed on June 18, 2024. This security issue impacts the presscustomizr Customizr theme, a popular WordPress theme (Patchstack).

The vulnerability stems from missing or incorrect nonce validation in the theme's functionality. It has been assigned CVE-2024-35771 and received varying CVSS scores: NIST assessed it with a CVSS v3.1 Base Score of 8.8 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, while Patchstack rated it at 4.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) (NVD).

The vulnerability allows unauthenticated attackers to dismiss notices via forged requests if they can trick a site administrator into performing specific actions, such as clicking on a malicious link. This could potentially lead to unauthorized actions being performed under the administrator's authentication context (WPScan).

The vulnerability requires user interaction and can be exploited by unauthenticated attackers. The attack vector is network-accessible and has low attack complexity, though it requires user interaction for successful exploitation (Patchstack).

The vulnerability has been fixed in version 4.4.22 of the Customizr theme. Users are advised to update to this version or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).