CVE-2024-12555 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the mgplugin SIP Calculator WordPress plugin in all versions up to and including 1.0. The issue arises from missing nonce validation on a function, enabling attackers to craft forged requests that can cause site administrators to unknowingly execute unwanted actions. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

An attacker can exploit this vulnerability by tricking a site administrator into clicking a malicious link, causing the administrator's browser to perform unauthorized actions on the vulnerable WordPress site. This can lead to limited confidentiality and integrity impacts within the scope of the affected site. There is no indication of availability impact or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, site administrators should exercise caution with links and consider implementing manual nonce validation or other CSRF protections in the plugin code. Monitoring for updates from mgplugin or WordPress security advisories is recommended.