CVE-2024-7420 is a CSRF vulnerability in the Insert PHP Code Snippet WordPress plugin (up to version 1.3.6) caused by missing or incorrect nonce validation in the /admin/snippets.php file. This allows attackers to perform unauthorized state-changing actions (activate, deactivate, delete snippets) by tricking an authenticated administrator into submitting a crafted request. The vulnerability does not require privileges or user interaction beyond the administrator clicking a malicious link. CVE-2024-43275 is a duplicate of this issue. No official patch or fix has been documented yet.

An attacker can cause an authenticated site administrator to unknowingly execute actions that modify code snippets, potentially altering site behavior or introducing malicious code. While the vulnerability does not directly disclose data or cause denial of service, it can lead to integrity issues by unauthorized modification of PHP code snippets. The CVSS score of 5.8 reflects a medium severity impact with no confidentiality or availability impact but with integrity impact and no required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on suspicious links and consider restricting access to the plugin's administrative interface. Implementing additional CSRF protections or nonce validation manually may mitigate the risk. Monitoring for updates from the plugin vendor is recommended.