CVE-2024-35657 is a CSRF vulnerability in the WP-Recall WordPress plugin developed by Plechev Andrey, affecting versions through 16.26.6. The vulnerability allows an attacker to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity and availability impacts. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. No official fix or patch is currently available, and no known active exploitation has been reported.

The vulnerability can lead to limited integrity and availability impacts by enabling unauthorized actions via CSRF attacks. There is no confidentiality impact reported. Since the attack requires user interaction and no privileges, the risk is moderate. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying standard CSRF mitigations such as disabling or restricting the plugin if feasible, or implementing additional security controls at the web application firewall level to detect and block CSRF attempts.