CVE-2024-2960 is a CSRF vulnerability in the SVS Pricing Tables plugin for WordPress, affecting all versions up to 1.0.4. The issue arises from missing or incorrect nonce validation in the deletePricingTable() function, which enables an attacker to craft a forged request that, if executed by an authenticated site administrator, can delete pricing tables without proper authorization. The vulnerability requires user interaction (UI:R) and does not impact confidentiality or availability but can cause limited integrity loss by unauthorized deletion of data.

An attacker can cause an authenticated administrator to unknowingly delete pricing tables via a forged request, resulting in limited integrity impact to the affected WordPress site. There is no direct confidentiality or availability impact reported. The vulnerability requires tricking a legitimate user into performing an action, such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links and consider implementing additional CSRF protections or disabling the plugin if feasible.