CVE-2024-4312 describes a CSRF vulnerability in the Soccer Engine – Soccer Plugin for WordPress, affecting all versions up to and including 1.12. The issue arises from improper or missing nonce validation during the saving of match and team settings, enabling attackers to craft malicious requests that, if executed by an authenticated administrator, can modify plugin configurations and data such as teams and players. The vulnerability requires user interaction (UI:R) but no privileges or authentication (PR:N) are needed by the attacker. The CVSS vector indicates network attack vector, low attack complexity, and no confidentiality or availability impact but limited integrity impact.

An attacker can cause an authenticated site administrator to unknowingly change plugin settings and data related to teams and players by tricking them into clicking a malicious link or visiting a crafted webpage. This can lead to unauthorized modifications within the plugin's scope but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or websites while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.