CVE-2024-11342 describes a CSRF vulnerability in the Skt NURCaptcha plugin for WordPress versions up to 3.5.0. The issue arises from improper or absent nonce validation in the skt-nurc-admin.php file, which is intended to protect against unauthorized state-changing requests. Exploitation requires social engineering to induce an administrator to execute a forged request, enabling attackers to modify plugin settings or inject malicious web scripts. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

Successful exploitation can lead to unauthorized modification of plugin settings and injection of malicious scripts, potentially compromising site integrity and administrator trust. The impact includes limited confidentiality and integrity loss but no availability impact. The vulnerability requires user interaction from an administrator, limiting the attack vector to targeted social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links and consider disabling or removing the Skt NURCaptcha plugin if feasible. Monitoring for suspicious administrative actions may help detect exploitation attempts.