CVE-2024-13432 is a Cross-Site Request Forgery vulnerability in the Webcamconsult WordPress plugin (versions up to and including 1.5.0). The issue arises from missing or incorrect nonce validation on a function that handles settings updates. This flaw enables unauthenticated attackers to craft malicious requests that, if executed by an authenticated site administrator, can update plugin settings and inject malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability.

An attacker can exploit this vulnerability to perform unauthorized changes to the Webcamconsult plugin settings and inject malicious scripts by tricking an authenticated administrator into executing a crafted request. This can lead to partial compromise of site integrity and confidentiality. There is no indication of impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger plugin settings changes. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.