CVE-2024-11812 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the Wtyczka SeoPilot dla WP WordPress plugin through improper or missing nonce validation in the SeoPilot_Admin_Options() function. This flaw enables attackers to forge requests that, when executed by an authenticated administrator, can modify plugin settings or inject malicious web scripts. The vulnerability affects all versions up to and including 3.3.091. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

An attacker who successfully exploits this vulnerability can cause an authenticated administrator to unknowingly perform unauthorized actions such as changing plugin settings or injecting malicious scripts. This can lead to partial confidentiality and integrity compromise of the affected WordPress site. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution by avoiding clicking on untrusted links while logged into the WordPress admin interface. Monitoring for updates from the SeoPilot plugin vendor is recommended to apply any forthcoming patches promptly.