CVE-2024-13522 is a Cross-Site Request Forgery vulnerability in the magayo Lottery Results WordPress plugin versions up to 2.0.12. The issue arises from missing or incorrect nonce validation on the plugin's settings page, enabling attackers to forge requests that can update settings or inject malicious scripts if an administrator is tricked into executing the action. The vulnerability is network exploitable without privileges but requires user interaction. It has a CVSS 3.1 base score of 6.1 (medium severity). No known exploits in the wild or vendor patches have been reported as of the published date.

Successful exploitation could allow an attacker to modify plugin settings and inject malicious web scripts by leveraging an administrator's authenticated session through a forged request. This can lead to limited confidentiality and integrity impacts on the affected site. Availability is not impacted. The attack requires user interaction (an administrator clicking a crafted link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on suspicious links and consider restricting access to the plugin's settings page to trusted users only. Monitoring for updates from the magayo plugin vendor is recommended to apply any official fixes once released.