CVE-2024-3947 is a CSRF vulnerability in the WP To Do plugin for WordPress, affecting all versions up to 1.3.0. The issue arises from missing or incorrect nonce validation in the wptodo_settings() function, enabling attackers to forge requests that modify plugin settings without proper authorization. Exploitation requires tricking a site administrator into executing an action, such as clicking a crafted link. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and no required privileges but user interaction is necessary. There is no vendor advisory or patch information available to confirm remediation status.

An attacker can cause unauthorized changes to the WP To Do plugin settings by exploiting the CSRF vulnerability, potentially impacting the integrity of the plugin's configuration. There is no indication of confidentiality or availability impact. The attack requires user interaction by an administrator and does not require prior authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links and consider implementing additional CSRF protections or restricting administrative access where possible.