CVE-2024-12572 is a Cross-Site Request Forgery vulnerability in the Hello In All Languages WordPress plugin by stathisg, affecting all versions up to and including 1.0.6. The issue arises from missing or incorrect nonce validation on a function, enabling attackers to perform unauthorized state-changing actions by tricking authenticated administrators into submitting forged requests. This can lead to unauthorized updates of plugin settings and injection of malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly perform actions such as changing plugin settings or injecting malicious scripts. This can lead to partial compromise of site integrity and confidentiality. There is no indication of availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on suspicious links and consider disabling or replacing the plugin if possible. Monitor official channels for updates from the vendor regarding patches or mitigations.