CVE-2024-12279 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the WP Social AutoConnect WordPress plugin in all versions up to 4.6.2. The issue arises from missing or incorrect nonce validation on a function, enabling attackers to craft forged requests that, when executed by a site administrator, can inject malicious web scripts or perform unauthorized actions. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and limited confidentiality and integrity impacts without availability impact.

Successful exploitation requires tricking a site administrator into interacting with a malicious link, which can lead to limited confidentiality and integrity impacts on the affected WordPress site. There is no indication of availability impact or known exploits in the wild. The vulnerability could allow unauthorized actions via forged requests due to improper nonce validation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to the WP Social AutoConnect plugin and consider disabling or restricting the plugin if possible to reduce risk.