CVE-2024-13718 is a CSRF vulnerability in the wpdesk Flexible Wishlist for WooCommerce plugin for WordPress, affecting all versions up to and including 1.2.26. The vulnerability is due to missing or incorrect nonce validation on several functions, enabling attackers to perform unauthorized modifications to user wishlists by leveraging a site administrator's interaction with a crafted request. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low complexity, no privileges required, but requiring user interaction.

An attacker can exploit this vulnerability to modify, update, or create wishlists belonging to other users by tricking a site administrator into clicking a malicious link or performing an action. This could lead to unauthorized changes in wishlist data but does not impact confidentiality or availability directly. The impact is limited to integrity of wishlist data within the affected plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or content that could trigger wishlist modifications. Monitoring vendor channels for updates or patches is recommended.