CVE-2024-2969 describes a CSRF vulnerability in the WP-Eggdrop plugin for WordPress, affecting all versions up to 0.1. The root cause is missing or incorrect nonce validation in the wpegg_updateOptions() function, which is responsible for updating plugin settings. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator, changes plugin configurations without proper authorization. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.4, reflecting low impact on confidentiality and integrity and no impact on availability. No patch or remediation has been documented in the provided information.

An attacker can cause unauthorized changes to the WP-Eggdrop plugin settings by exploiting the CSRF vulnerability, potentially leading to altered plugin behavior or configuration. The impact is limited to confidentiality and integrity with low severity, and there is no indication of availability impact. Exploitation requires tricking an authenticated site administrator into performing an action, such as clicking a malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking untrusted links while logged into WordPress sites using the WP-Eggdrop plugin. Monitoring official vendor channels for updates or patches is recommended.