CVE-2024-0623 is a CSRF vulnerability in the VK Block Patterns WordPress plugin (up to version 1.31.1.1). The issue arises from missing or incorrect nonce validation on the vbp_clear_patterns_cache() function, enabling attackers to clear the patterns cache by tricking an authenticated site administrator into executing a forged request. This vulnerability requires user interaction (UI:R) and does not require privileges (PR:N). The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker can cause an authenticated site administrator to clear the patterns cache via a CSRF attack, potentially disrupting the normal operation of the VK Block Patterns plugin. There is no direct impact on confidentiality or availability, but the integrity of the plugin's cached data can be affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or nonce validation in the plugin code can mitigate this vulnerability.