CVE-2024-13683 is a CSRF vulnerability in the Automate Hub Free WordPress plugin by Sperse.IO, present in all versions up to 1.7.0. The vulnerability is caused by missing or incorrect nonce validation on the 'automate_hub' page, which enables an attacker to forge requests that update activation status if a site administrator is tricked into executing the action. This vulnerability does not require privileges but does require user interaction (UI:R). The CVSS vector indicates network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause a site administrator to unknowingly update the activation status of the plugin via a forged request. This could lead to unauthorized changes in plugin activation state but does not directly impact confidentiality or availability. The integrity impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing manual nonce validation or other CSRF protections on the 'automate_hub' page may mitigate the risk.