CVE-2024-4426 is a CSRF vulnerability in the Comparison Slider WordPress plugin (up to version 1.0.5). The issue arises because several AJAX action handlers lack proper nonce validation, enabling attackers to forge requests that execute privileged actions without authentication. Exploitation requires social engineering to convince an administrator to trigger the malicious request. The vulnerability impacts integrity by allowing unauthorized modification of slider titles, deletion of sliders, and changes to plugin settings. No known exploits in the wild have been reported, and no patch or official fix has been documented yet.

An attacker can cause an authenticated administrator to unknowingly perform unauthorized actions on the plugin, such as altering slider titles, deleting sliders, or changing plugin settings. This compromises the integrity of the affected WordPress site’s content and configuration related to the Comparison Slider plugin. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links while logged into WordPress sites using the vulnerable plugin. Monitoring for plugin updates and applying them promptly once released is recommended.