CVE-2024-12385 is a Cross-Site Request Forgery (CWE-352) vulnerability in the WP Abstracts plugin for WordPress, affecting all versions up to 2.7.2. The issue arises because the functions wpabstracts_load_status() and wpabstracts_delete_abstracts() lack nonce validation, which is a security mechanism to verify the legitimacy of requests. This flaw enables unauthenticated attackers to craft malicious requests that, if executed by an authenticated site administrator, can cause unauthorized actions on the site. The CVSS v3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker can exploit this vulnerability by tricking an authenticated site administrator into clicking a malicious link or visiting a crafted webpage, causing the administrator's browser to perform unauthorized actions on the vulnerable WordPress site. This can lead to limited confidentiality and integrity impacts, such as unauthorized changes to abstracts managed by the plugin. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, site administrators should monitor the vendor's communications for updates. Until a fix is available, administrators should exercise caution when clicking links and consider restricting administrative access or implementing additional CSRF protections if possible.