CVE-2024-37198: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the blazethemes Digital Newspaper WordPress theme, affecting versions up to and including 1.1.5. The vulnerability was initially reported by Dhabaleshwar Das on January 27, 2024, and was publicly disclosed on June 20, 2024 (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and has received varying CVSS scores: a CVSS 3.1 Base Score of 8.8 (HIGH) from NIST with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and a CVSS 3.1 score of 4.3 (MEDIUM) from Patchstack with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (NVD).

The vulnerability could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. Specifically, it enables unauthenticated attackers to dismiss notices via a forged request if they can trick a site administrator into performing an action such as clicking on a link (WPScan).

The vulnerability requires no authentication to exploit, though it does require user interaction. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 1.1.6 of the Digital Newspaper theme. Users are advised to update to version 1.1.6 or later to remove the vulnerability (Patchstack).