CVE-2024-11419 is a CSRF vulnerability in the Password for WP plugin for WordPress affecting all versions up to and including 1.5. The issue arises from missing or incorrect nonce validation in the get3_init_admin_page() function, enabling attackers to perform unauthorized state-changing actions by tricking an administrator into clicking a crafted link. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to cause an administrator to unknowingly update plugin settings or inject malicious web scripts, potentially leading to partial compromise of site integrity and confidentiality. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider disabling or replacing the affected plugin to mitigate risk.