CVE-2024-2395 affects the Bulgarisation for WooCommerce plugin for WordPress, where missing or incorrect nonce validation leads to a Cross-Site Request Forgery vulnerability. This allows attackers to perform unauthorized label creation and deletion by convincing an administrator to execute a crafted request. The vulnerability impacts all versions up to and including 3.0.14. It is identified as CWE-862 (Missing Authorization). The CVSS 3.1 base score is 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized creation and deletion of labels within the WooCommerce plugin, potentially disrupting site operations and affecting data integrity. Because the attack requires tricking an administrator into performing an action, the risk depends on social engineering success. The vulnerability affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider restricting administrative access or implementing additional CSRF protections at the WordPress or server level. Monitor official channels from autopolisbg for updates and patches.