CVE-2024-34817 is a CWE-352 Cross-Site Request Forgery vulnerability affecting the CRM Perks Integration plugin for Pipedrive and several WordPress form plugins (Contact Form 7, WPForms, Elementor, Ninja Forms) in versions up to 1.2.0. The vulnerability allows attackers to induce authenticated users to perform unwanted actions without their consent. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only. No official patch or remediation level has been published by the vendor as of the publication date.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to unknowingly perform actions within the affected plugin, potentially leading to limited integrity impact. There is no confidentiality or availability impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider limiting user privileges and educating users about the risks of clicking on untrusted links. Monitor official vendor channels for updates regarding patches or mitigations.