CVE-2024-13444 is a CSRF vulnerability in the tuxlog wp-greet WordPress plugin affecting all versions up to and including 6.2. The issue arises from missing or incorrect nonce validation in a function, enabling attackers to perform unauthorized state-changing actions by convincing an administrator to click a crafted link. This vulnerability can lead to partial compromise of site integrity through settings modification and script injection. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability to cause an administrator to unknowingly update plugin settings or inject malicious web scripts, potentially leading to partial compromise of site integrity and confidentiality. There is no direct impact on availability. The vulnerability requires user interaction (administrator clicking a malicious link) and does not require prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links and consider disabling or removing the wp-greet plugin if it is not essential. Monitor official tuxlog or WordPress plugin repositories for updates addressing this vulnerability.