CVE-2024-13560 identifies a CSRF vulnerability in the Subscriptions & Memberships for PayPal WordPress plugin (all versions up to 1.1.6). The issue arises from missing or incorrect nonce validation on a function, enabling attackers to craft malicious requests that, if executed by an authenticated administrator, can delete arbitrary posts. The vulnerability requires user interaction (UI:R) and does not grant direct confidentiality or availability impact but allows limited integrity impact (deletion of posts).

An attacker can cause an authenticated site administrator to unknowingly delete arbitrary posts by tricking them into clicking a malicious link. This impacts the integrity of site content but does not affect confidentiality or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests related to this plugin and consider disabling or restricting plugin usage if possible to mitigate risk.