CVE-2024-10040 describes a CSRF vulnerability in the Infinite-Scroll WordPress plugin by paulirish-1. The issue arises because the plugin's process_ajax_edit and process_ajax_delete functions lack proper nonce validation, enabling attackers to forge requests that modify plugin settings without authentication. Exploitation requires social engineering to convince an administrator to trigger the malicious request. The vulnerability affects all versions up to 2.6.2 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No known exploits in the wild or vendor patches are currently documented.

An attacker can cause unauthorized changes to the Infinite-Scroll plugin settings by exploiting the CSRF vulnerability, potentially impacting site configuration integrity. There is no direct confidentiality or availability impact reported. The attack requires tricking an administrator into performing an action, so it depends on successful social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links and consider disabling or limiting the use of the Infinite-Scroll plugin. Monitoring official paulirish-1 or WordPress security advisories for updates is recommended.