CVE-2024-12004 is a CSRF vulnerability in the WPC Order Notes for WooCommerce plugin for WordPress, affecting all versions up to and including 1.5.2. The issue arises from missing or incorrect nonce validation on the ajax_update_order_note() function, which can allow an attacker to forge requests that execute actions on behalf of an authenticated administrator. This vulnerability requires user interaction (UI:R) and has a network attack vector (AV:N). The impact includes limited confidentiality and integrity loss but no availability impact, reflected in a CVSS 3.1 score of 6.1.

Successful exploitation could allow an attacker to perform unauthorized actions by injecting malicious scripts through forged requests if an administrator is tricked into clicking a malicious link. This can lead to limited confidentiality and integrity compromise within the affected WordPress site. There is no indication of availability impact or widespread exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests related to the WPC Order Notes for WooCommerce plugin and consider disabling or restricting access to the vulnerable functionality if possible.