CVE-2024-1162 is a CSRF vulnerability in the Orbit Fox by ThemeIsle WordPress plugin affecting all versions up to and including 2.10.29. The issue arises from missing or incorrect nonce validation on the register_reference() function, enabling attackers to forge requests that update API keys when an authenticated administrator interacts with a crafted link. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

An attacker can exploit this vulnerability to update API keys connected to the plugin by tricking an administrator into clicking a malicious link. This could lead to unauthorized changes in the plugin's configuration related to API keys, potentially impacting the integrity of the affected system. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges and consider limiting administrative access. Monitor the vendor's communications for updates regarding a security patch.