CVE-2024-1339 identifies a CSRF vulnerability in the ImageRecycle pdf & image compression WordPress plugin (up to version 3.1.13). The issue arises from missing or incorrect nonce validation on the reinitialize function, enabling attackers to forge requests that cause an administrator to unintentionally remove all plugin data. The vulnerability requires user interaction (UI:R) and does not grant direct confidentiality or availability impact but allows limited integrity impact by data removal. No known exploits are reported in the wild, and no patch or remediation details are available from the vendor at this time.

An attacker can exploit this vulnerability by tricking a site administrator into clicking a malicious link, which causes the removal of all plugin data. This results in limited integrity impact on the affected plugin's data but does not affect confidentiality or availability beyond the plugin data. There is no indication of broader system compromise or data leakage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking untrusted links and consider restricting administrative access or implementing additional CSRF protections at the site level to mitigate risk.