CVE-2024-13494 is a CSRF vulnerability in the WordPress File Upload plugin by nickboss, affecting all versions up to and including 4.25.2. The issue arises from missing or incorrect nonce validation on the 'wfu_file_details' function, enabling attackers to forge requests that modify user data related to uploaded files. Exploitation requires tricking an authenticated site administrator into executing a crafted request. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). There is no evidence of known exploits in the wild or an official patch available at this time.

Successful exploitation allows an attacker to modify user data details associated with uploaded files without authentication, but only if an authenticated administrator is tricked into performing the action. The impact is limited to integrity (I:L) with no confidentiality or availability impact. The attack requires user interaction (UI:R) and network access (AV:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links or performing actions from untrusted sources. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.