CVE-2024-37413: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the Rara Theme Preschool and Kindergarten WordPress theme, affecting versions up to 1.2.1. The vulnerability was reported by Dhabaleshwar Das on January 30, 2024, and was publicly disclosed on June 28, 2024. The issue was assigned CVE-2024-37413 (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability is classified as CWE-352: Cross-Site Request Forgery (CSRF) (Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The severity impact is considered low and is unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 1.2.2 of the Preschool and Kindergarten theme. Users are advised to update to version 1.2.2 or later to remove the vulnerability (Patchstack).