CVE-2024-6853: 
WordPress vulnerability analysis and mitigation

The WP MultiTasking WordPress plugin through version 0.1.12 contains a Cross-Site Request Forgery (CSRF) vulnerability that affects the welcome popups update functionality. The vulnerability was discovered by Norbert Hofmann and was publicly disclosed on August 17, 2024. This security issue has been assigned CVE-2024-6853 and has received a CVSS v3.1 base score of 4.3 (Medium) from NIST and 6.5 (Medium) from CISA-ADP (NVD, WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms when updating welcome popups in the plugin. This security weakness is classified as CWE-352 (Cross-Site Request Forgery). The vulnerability has received varying severity assessments, with NIST assigning a CVSS v3.1 score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) and CISA-ADP assigning a score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) (NVD).

If exploited, this vulnerability could allow attackers to make logged-in administrators perform unauthorized actions related to welcome popup updates through CSRF attacks. The impact primarily affects the integrity of the system's welcome popup configurations (WPScan).

The vulnerability can be exploited by crafting a malicious HTML page that, when accessed by a logged-in administrator, triggers unauthorized welcome popup updates. A proof of concept exists demonstrating the exploitation method through a form submission (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WP MultiTasking plugin version 0.1.12 or earlier should consider implementing additional security measures or temporarily disabling the welcome popup functionality until a patch is released (WPScan).