CVE-2024-54372 is a CSRF vulnerability in the Insertify plugin by Sourov Amin that enables code injection attacks. It affects all versions up to 1.1.4. The vulnerability allows remote attackers to trick authenticated users into executing unwanted actions that result in code injection, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity with low impact on availability. No patch or official fix has been disclosed yet.

Successful exploitation of this vulnerability can lead to code injection, allowing attackers to execute arbitrary code remotely. This compromises the confidentiality and integrity of the affected system and can cause partial availability loss. Given the critical CVSS score, the impact is severe, potentially enabling full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to Insertify, applying web application firewalls with CSRF protections, and avoiding actions that require user interaction with untrusted sites. Monitor vendor channels for updates and patches.