CVE-2024-39679: 
WordPress vulnerability analysis and mitigation

The Cooked plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability (CVE-2024-39679) in versions up to and including 1.7.15.4. The vulnerability was discovered and disclosed on July 17, 2024, affecting the WordPress recipe plugin Cooked. The issue stems from missing or incorrect nonce validation on the AJAX action handler (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH by NIST (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while GitHub assigned it a score of 4.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). The vulnerability is classified as CWE-352 (Cross-Site Request Forgery). The issue specifically involves the AJAX action handler lacking proper nonce validation, which is essential for preventing CSRF attacks (NVD).

This vulnerability could allow an attacker to trick authenticated users into performing unintended actions under their current authentication level. The impact primarily affects the integrity of the system, as indicated by the CVSS metrics showing potential for unauthorized actions to be performed on behalf of authenticated users (GitHub Advisory).

The vulnerability requires user interaction for exploitation, as indicated by the UI:R parameter in the CVSS score. The attack vector is network-based (AV:N) with low attack complexity (AC:L), and no privileges are required (PR:N) for exploitation (NVD).

The vulnerability has been addressed in release version 1.8.0. Users are strongly advised to upgrade to this version as there are no known workarounds for this vulnerability (GitHub Advisory).