CVE-2024-6405 describes a CSRF vulnerability in the Floating Social Buttons plugin for WordPress, affecting all versions up to 1.5. The root cause is the absence or improper implementation of nonce validation in the floating_social_buttons_option() function. This flaw enables attackers to craft forged requests that, when executed by an authenticated site administrator, can alter plugin settings and inject malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting a medium impact with network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

An attacker can exploit this vulnerability by tricking a site administrator into clicking a malicious link, resulting in unauthorized changes to the plugin's settings and possible injection of malicious scripts. This could lead to partial compromise of site integrity and confidentiality. There is no indication of availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests that could trigger plugin setting changes. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.