CVE-2024-0373 describes a CSRF vulnerability in the Views for WPForms plugin for WordPress, specifically in the 'save_view' function where nonce validation is missing or incorrect. This improper access control (CWE-284) allows attackers to craft malicious requests that, when executed by an authenticated site administrator, can modify post titles without proper authorization. The vulnerability affects all versions up to and including 3.2.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker can cause an authenticated administrator to unknowingly modify arbitrary post titles on the affected WordPress site by exploiting the CSRF vulnerability. This results in limited integrity impact but does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should exercise caution when clicking on untrusted links and consider disabling or restricting the use of the vulnerable plugin. Monitoring vendor channels for updates is recommended.