CVE-2024-4529: 
WordPress vulnerability analysis and mitigation

The Business Card WordPress plugin through version 1.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. The vulnerability was discovered and disclosed on May 27, 2024, and was assigned CVE-2024-4529. The affected software is the Business Card WordPress plugin by Esterox (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms in certain plugin functionalities. The plugin lacks proper CSRF checks, which makes it vulnerable to cross-site request forgery attacks. The vulnerability has been assigned a CVSS 3.1 base score of 5.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L (WPScan).

When exploited, this vulnerability allows attackers to make logged-in users perform unwanted actions without their knowledge or consent. Specifically, attackers can trick authenticated users into deleting card categories through CSRF attacks (WPScan).

The vulnerability requires user interaction and can be exploited by making a logged-in administrator open a specially crafted HTML document. The attack complexity is considered high, but no authentication is required from the attacker's side (WPScan).

Currently, there is no known fix available for this vulnerability in the Business Card WordPress plugin (WPScan).