CVE-2024-3945 describes a CSRF vulnerability in the WP To Do plugin for WordPress, affecting all versions up to and including 1.3.0. The root cause is the absence or incorrect implementation of nonce validation in the wptodo_manage() function, which is intended to protect against unauthorized requests. Exploitation requires an attacker to trick an authenticated site administrator into submitting a crafted request, enabling the attacker to add new todo items without proper authorization. The vulnerability does not impact confidentiality or availability but allows limited integrity impact by unauthorized modification of todo items.

The vulnerability allows an attacker to add unauthorized todo items by exploiting the lack of nonce validation, potentially causing unauthorized content modification. There is no impact on confidentiality or availability. The overall severity is medium (CVSS 4.3). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests that could trigger the vulnerable function. Monitoring for plugin updates from the vendor delower186 is recommended to apply an official fix once available.