CVE-2024-3246 describes a CSRF vulnerability in the LiteSpeed Cache WordPress plugin affecting all versions up to 6.2.0.1. The issue arises from improper or missing nonce validation, enabling attackers to forge requests that can update token settings and inject malicious JavaScript code. Exploitation requires social engineering to convince an administrator to perform an action that triggers the malicious request. The vulnerability has a CVSS 3.1 base score of 6.1 (medium severity) with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

An attacker can exploit this vulnerability to update token settings and inject malicious JavaScript code into the affected WordPress site by tricking an administrator into clicking a malicious link. This can lead to partial compromise of site integrity and confidentiality. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on untrusted links and consider implementing additional CSRF protections or disabling the plugin if feasible. Monitor official LiteSpeed and WordPress security channels for updates.