CVE-2024-11417 is a CSRF vulnerability in the dejure.org Vernetzungsfunktion WordPress plugin affecting all versions up to and including 1.97.5. The vulnerability arises from missing or incorrect nonce validation in the djo_einstellungen_menue() function, enabling attackers to perform unauthorized state-changing actions by leveraging the privileges of an authenticated administrator who is tricked into clicking a malicious link. This can lead to unauthorized settings changes and injection of malicious web scripts. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly perform actions that update plugin settings or inject malicious scripts. This can lead to partial compromise of site integrity and confidentiality. There is no indication of impact on availability. The vulnerability requires user interaction (administrator clicking a crafted link) and does not require prior authentication by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links and consider disabling or removing the affected plugin if possible. Monitoring for plugin updates from dejureorg is recommended to apply any forthcoming official fixes promptly.