CVE-2024-12386 is a CSRF vulnerability in the WP Abstracts plugin for WordPress, affecting all versions up to 2.7.3. The issue arises from missing nonce validation on several functions, enabling attackers to forge requests that can delete arbitrary user accounts if an administrator is tricked into clicking a malicious link. The vulnerability is remotely exploitable without authentication but requires user interaction (UI:R). It has a CVSS 3.1 score of 8.1, indicating high impact on integrity and availability.

Successful exploitation allows an attacker to delete arbitrary user accounts on a vulnerable WordPress site by leveraging an administrator's authenticated session through a forged request. This impacts the integrity and availability of the affected site by enabling unauthorized account deletions. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider disabling or replacing the WP Abstracts plugin if possible. Monitoring for updates from the plugin vendor or WordPress security sources is recommended.