CVE-2024-12557 is a Cross-Site Request Forgery (CWE-352) vulnerability in the Transporters.io WordPress plugin, affecting all versions up to and including 2.1.1. The issue arises from missing nonce validation on a plugin function, which enables attackers to craft forged requests that, if executed by an authenticated site administrator, can lead to unauthorized actions including injection of malicious scripts. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch information available to confirm remediation status.

Successful exploitation can allow an attacker to perform unauthorized actions on behalf of an authenticated administrator by tricking them into clicking a malicious link. This can lead to limited confidentiality and integrity impacts through injection of malicious web scripts. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to the Transporters.io plugin and consider disabling or removing the plugin if possible to reduce risk.