CVE-2024-2959 describes a CSRF vulnerability in the SVS Pricing Tables plugin for WordPress, affecting all versions up to 1.0.4. The root cause is the absence or improper implementation of nonce validation in the savePricingTable() function, which is intended to protect against unauthorized requests. Exploitation requires social engineering to induce an authenticated administrator to execute a crafted request, enabling unauthorized creation or modification of pricing tables. The vulnerability is classified under CWE-352 and has a CVSS 3.1 base score of 4.3 (medium severity). There is no indication of known exploits in the wild or an available patch at this time.

An attacker can leverage this CSRF vulnerability to alter pricing tables without authentication by tricking an administrator into performing an action. This could lead to unauthorized changes in pricing information, potentially impacting website integrity and user trust. The vulnerability does not allow direct confidentiality or availability impact but does permit limited integrity modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on untrusted links while logged into the WordPress admin interface and consider implementing additional CSRF protections or disabling the plugin if feasible.