CVE-2024-12005 is a CSRF vulnerability in the WP-BibTeX plugin for WordPress affecting all versions up to 3.0.1. The issue arises from missing or incorrect nonce validation in the wp_bibtex_option_page() function, which is intended to protect against unauthorized requests. An attacker can exploit this by tricking an authenticated site administrator into submitting a crafted request, leading to unauthorized actions such as injecting malicious scripts. The vulnerability has a CVSS 3.1 score of 6.1, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, but user interaction needed, and partial confidentiality and integrity impact.

Successful exploitation could allow an attacker to perform unauthorized actions on behalf of an authenticated administrator, including injecting malicious web scripts. This can lead to partial compromise of confidentiality and integrity of the affected site. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution by avoiding clicking on suspicious links and consider implementing additional CSRF protections or disabling the plugin if feasible.