CVE-2024-2970 is a CSRF vulnerability in the tsina News Wall WordPress plugin versions up to 1.1.0. The issue arises from missing or incorrect nonce validation on the nwap_newslist_page() function, which handles plugin settings and news list modifications. An attacker can exploit this by crafting a forged request that, when executed by a site administrator, results in unauthorized changes to the plugin's configuration or content. The vulnerability does not require privileges or direct authentication but relies on user interaction (UI:R). The CVSS 3.1 base score is 4.3, reflecting low complexity and network attack vector but limited impact (integrity only).

Successful exploitation allows an attacker to modify the News Wall plugin's settings and news lists without authentication, potentially altering displayed content or plugin behavior. There is no direct confidentiality or availability impact reported. The attack requires tricking an administrator into performing an action, so social engineering is a factor. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking suspicious links and consider disabling or removing the News Wall plugin if not essential. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.