CVE-2024-6168 is a CSRF vulnerability in the Just Custom Fields WordPress plugin (versions up to 3.3.2) caused by missing or incorrect nonce validation on multiple AJAX functions. This allows attackers to exploit the plugin by crafting forged requests that an authenticated administrator might unwittingly execute, enabling unauthorized management of field groups and visibility settings. The vulnerability does not require privileges or direct user interaction beyond tricking an admin to click a link. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring user interaction but no privileges.

An attacker can cause an authenticated administrator to perform unintended actions within the Just Custom Fields plugin, such as managing field groups or altering visibility settings. This could lead to unauthorized changes in the WordPress site's custom field configurations. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been identified at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links or interacting with untrusted sources. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming official fixes promptly.