CVE-2024-4541 is a CSRF vulnerability in the viitorcloudvc Custom Product List Table WordPress plugin affecting all versions up to 3.0.0. The issue arises from missing or incorrect nonce validation during product modification operations. An attacker can exploit this by crafting a forged request that, when executed by an authenticated site administrator, results in unauthorized changes to product data. The vulnerability does not require privileges or direct authentication but relies on social engineering to induce an administrator to perform the action.

Exploitation of this vulnerability can lead to unauthorized modification of product data including adding, deleting, bulk editing, approving, or canceling products. There is no direct impact on confidentiality or availability reported. The impact is limited to integrity of product data managed by the plugin. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on suspicious links and consider implementing additional CSRF protections or disabling the plugin if feasible.