CVE-2024-12288 identifies a CSRF vulnerability in the Simple add pages or posts plugin for WordPress, affecting all versions up to 2.0.0. The root cause is missing or incorrect nonce validation, which is a security mechanism designed to prevent unauthorized commands from being executed via forged requests. Exploitation requires an attacker to convince a site administrator to perform an action, such as clicking a malicious link, which then triggers unauthorized changes including settings updates or script injections. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no indication of known exploits in the wild or available patches at this time.

Successful exploitation can lead to unauthorized modification of plugin settings and injection of malicious web scripts, potentially compromising the integrity and confidentiality of the affected WordPress site. The attacker must rely on social engineering to induce an administrator to perform the action. There is no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links and consider disabling or replacing the affected plugin to mitigate risk. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.