CVE-2024-1361 is a CSRF vulnerability in the Colibri Page Builder WordPress plugin caused by missing or incorrect nonce validation on the apiCall() function. This allows unauthenticated attackers to perform limited actions like importing images, deleting posts, or saving theme data by tricking an authenticated site administrator into executing a forged request. The vulnerability affects all versions up to and including 1.0.253 and has a CVSS 3.1 base score of 4.3 (medium severity). There is no vendor advisory or patch link provided, and the product is not a cloud service.

Successful exploitation can result in limited unauthorized actions such as importing images, deleting posts, or modifying theme data on affected WordPress sites running the vulnerable Colibri Page Builder plugin. The impact is limited to integrity changes without direct confidentiality or availability impact. The attacker requires user interaction from an authenticated administrator to trigger the exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider disabling or removing the Colibri Page Builder plugin if possible. Monitoring for plugin updates from extendthemes is recommended to apply any forthcoming patches promptly.