CVE-2024-0790 identifies multiple CSRF vulnerabilities in the WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress, affecting all versions up to 1.0.8.1. The vulnerabilities stem from missing or incorrect nonce validation in functions such as wpbe_create_new_term, wpbe_update_tax_term, wpbe_delete_tax_term, wpbe_save_options, wpbe_bulk_delete_posts_count, wpbe_bulk_delete_posts, and wpbe_save_meta. These flaws allow attackers to perform unauthorized actions like creating, modifying, or deleting taxonomy terms, updating plugin options, deleting posts, and modifying post metadata by tricking an authenticated site administrator into submitting a malicious request. The CVSS 3.1 base score is 5.4, reflecting a medium impact primarily on integrity and availability, with no confidentiality impact. No known exploits in the wild have been reported, and no patch or remediation details are provided in the available data.

An attacker can exploit these CSRF vulnerabilities to cause an authenticated site administrator to unknowingly perform unauthorized actions, including creating, modifying, or deleting taxonomy terms, updating plugin options, deleting posts, and modifying post metadata. This can lead to partial loss of data integrity and availability within the affected WordPress site. There is no direct confidentiality impact reported. The overall severity is medium (CVSS 5.4).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or limiting the use of the affected plugin or restricting administrative access to trusted users only. Additionally, implementing web application firewalls or CSRF protection mechanisms at the site level may help mitigate risk. Monitor vendor channels for updates or patches addressing these vulnerabilities.