CVE-2024-12293 describes a CSRF vulnerability in the shinephp User Role Editor WordPress plugin affecting all versions up to 4.64.3. The issue arises from missing or incorrect nonce validation in the update_roles() function, enabling attackers to forge requests that manipulate user roles without authentication. Successful exploitation can lead to privilege escalation by adding administrator roles to arbitrary users when a site administrator is tricked into clicking a malicious link.

An attacker can exploit this vulnerability to add or remove roles for arbitrary users, including elevating privileges to administrator level. This compromises the integrity and confidentiality of the affected WordPress site by allowing unauthorized privilege escalation. The vulnerability requires user interaction (UI:R) but no prior privileges or authentication (PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with user interactions and consider disabling or restricting the User Role Editor plugin. Monitoring for updates from the vendor or WordPress plugin repository is recommended to apply any forthcoming patches promptly.