CVE-2024-13710 is a CSRF vulnerability in the Estatebud – Properties & Listings WordPress plugin affecting all versions up to 5.5.0. The issue arises from missing or incorrect nonce validation on the 'estatebud_settings' page, which is intended to protect against unauthorized requests. An attacker can exploit this by tricking an authenticated administrator into submitting a forged request, allowing unauthorized modification of plugin settings. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3, reflecting low impact on confidentiality and availability but some impact on integrity. No patch or official fix has been documented yet.

An attacker who successfully exploits this vulnerability can cause unauthorized changes to the plugin's settings by leveraging an authenticated administrator's session. This could lead to altered plugin behavior or configuration without the administrator's consent. There is no direct impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution by avoiding clicking on suspicious links and consider restricting administrative access or implementing additional CSRF protections at the site level. Monitoring for updates from the vendor is recommended.