CVE-2024-11444 describes a CSRF vulnerability in the CLUEVO LMS WordPress plugin due to improper nonce validation in the cluevo_render_module_ui() function. This allows attackers to craft malicious requests that, when executed by an authenticated administrator, can delete modules without their consent. The vulnerability affects all versions up to 1.13.2. The CVSS 3.1 base score is 4.3, reflecting low attack complexity but requiring user interaction and no direct confidentiality or availability impact.

An attacker can cause an authenticated site administrator to unknowingly delete modules in the CLUEVO LMS plugin by exploiting the CSRF vulnerability. This results in integrity loss of the e-learning platform's content or configuration. There is no direct impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links while logged into the WordPress site. Implementing additional CSRF protections or disabling the affected functionality temporarily may reduce risk.