CVE-2024-13758 is a CSRF vulnerability in the CP Contact Form with PayPal WordPress plugin affecting all versions up to 1.3.52. The issue arises from missing or incorrect nonce validation in the cp_contact_form_paypal_check_init_actions() function, enabling attackers to perform unauthorized actions such as adding discount codes by tricking authenticated administrators into executing forged requests. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), reflecting a medium severity impact focused on integrity.

Successful exploitation allows an attacker to add discount codes without authentication by leveraging a CSRF attack against an administrator. This compromises the integrity of the affected system by enabling unauthorized modification of discount codes. There is no impact on confidentiality or availability reported. No known exploits in the wild have been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider implementing additional CSRF protections or disabling the vulnerable plugin if possible.