CVE-2024-4103 describes a Cross-Site Request Forgery (CWE-352) vulnerability in the giuliopanda ADFO – Custom data in admin dashboard WordPress plugin. The issue arises from missing or incorrect nonce validation on multiple functions hooked via the controller() function, allowing unauthorized modification of plugin settings through forged requests. Exploitation requires tricking an authenticated site administrator into executing an action, such as clicking a crafted link. The vulnerability affects all versions up to and including 1.9.0. No known exploits are reported in the wild, and no patch or remediation details are currently available.

An attacker can cause an authenticated administrator to unknowingly change plugin settings via a forged request, potentially leading to unauthorized configuration changes. There is no direct confidentiality or availability impact reported. The impact is limited to integrity of plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links and consider limiting administrative access or using additional security plugins that provide CSRF protections.