CVE-2024-4218 describes a CSRF vulnerability in the AffiEasy WordPress plugin by perrinalexandre05 affecting all versions up to 1.1.6. The issue arises because the patched version of the plugin was not properly released; instead, the vulnerable core files remain in use while the fixed code is only present in a 'trunk' folder. This flaw allows unauthenticated attackers to perform various actions if they can trick an administrator into clicking a malicious link, leveraging the administrator's privileges. The CVSS 3.1 base score is 6.5, reflecting a medium impact on confidentiality and integrity without affecting availability. No known exploits in the wild have been reported, and no vendor advisory or patch link is provided.

Successful exploitation allows an attacker to perform unauthorized actions on the affected WordPress site by exploiting the administrator's session through CSRF. This can lead to limited confidentiality and integrity impacts as indicated by the CVSS vector. There is no indication of availability impact or active exploitation in the wild. The vulnerability affects all versions up to 1.1.6 of the AffiEasy plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is provided in the available data, administrators should monitor the vendor's communications for an official update. In the meantime, limiting administrator exposure to untrusted links and disabling or removing the vulnerable plugin may reduce risk.