CVE-2024-0613 is a CSRF vulnerability in the gluten Delete Custom Fields WordPress plugin affecting all versions up to 0.3.1. The vulnerability arises from missing or incorrect nonce validation in the ajax_delete_field() function, enabling attackers to forge requests that cause authenticated administrators to delete arbitrary post meta data without their explicit intent. This vulnerability requires user interaction (UI:R) and has network attack vector (AV:N) with no privileges required (PR:N).

Successful exploitation allows an attacker to delete arbitrary post meta data by tricking an authenticated site administrator into performing a crafted action, potentially leading to data loss or manipulation of site content metadata. The impact is limited to confidentiality and integrity of post meta data, with no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into the WordPress admin interface and consider disabling or removing the vulnerable plugin. Implementing additional CSRF protections or nonce validation in the plugin code can mitigate the risk.