CVE-2024-54426: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Andy Fradelakis LeaderBoard Plugin, identified as CVE-2024-54426. The vulnerability affects LeaderBoard Plugin versions through 1.2.4 and allows for Stored Cross-Site Scripting attacks. The issue was initially reported by researcher SOPROBRO on October 28, 2024, and was publicly disclosed on December 12, 2024 (Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and requires no authentication for exploitation (Patchstack).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The impact includes potential data compromise, integrity issues, and limited availability concerns as indicated by the CVSS metrics (Patchstack).

As of the latest reports, no official fix is available for this vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).