CVE-2024-13523 is a CSRF vulnerability in the MemorialDay WordPress plugin (versions ≤ 1.0.4) caused by missing or incorrect nonce validation. This flaw enables attackers to craft forged requests that, when executed by an authenticated site administrator, can update plugin settings or inject malicious web scripts. The vulnerability requires user interaction (UI:R) and has network attack vector (AV:N) with low attack complexity (AC:L). The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker can exploit this vulnerability by tricking a site administrator into clicking a malicious link, leading to unauthorized changes in plugin settings and potential injection of malicious scripts. This compromises the integrity and confidentiality of the affected WordPress site’s plugin configuration. There is no indication of availability impact or widespread exploitation at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges and consider disabling or removing the MemorialDay plugin if possible to mitigate risk.