CVE-2024-10045 is a Cross-Site Request Forgery vulnerability in the smub Transients Manager WordPress plugin affecting all versions up to 2.0.6. The issue arises from missing or incorrect nonce validation in the process_actions function, enabling attackers to forge requests that cause deletion of transients when a site administrator interacts with a crafted link. This vulnerability does not require privileges but does require user interaction (UI:R). The CVSS 3.1 base score is 4.3 (medium severity), reflecting low impact on integrity and no impact on confidentiality or availability.

An attacker can cause deletion of transients by tricking a site administrator into performing an action such as clicking a malicious link. This could lead to unintended data removal affecting site functionality or performance. There is no direct impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider restricting administrative access or using additional CSRF protection mechanisms if possible.