CVE-2024-2964 is a Cross-Site Request Forgery vulnerability in the Pocket News Generator WordPress plugin (versions up to 0.2.0). The issue arises from missing or incorrect nonce validation in the option_page() function, which is responsible for handling plugin settings. This allows an attacker to craft a malicious request that, if executed by an authenticated site administrator, can update plugin settings without proper authorization. The vulnerability is remotely exploitable without privileges but requires user interaction (UI:R).

Successful exploitation can lead to unauthorized modification of the plugin's settings by an attacker without authentication. This could potentially affect the integrity and behavior of the plugin but does not directly impact confidentiality or availability. The CVSS score of 5.4 reflects limited impact confined to integrity with no direct impact on availability or confidentiality.

No official patch or fix is currently available as per the provided information. Users should monitor the vendor's advisory channels for updates. Until a fix is released, administrators should be cautious about clicking on untrusted links while logged into WordPress admin interfaces and consider restricting administrative access or using additional security plugins that provide CSRF protections.