CVE-2024-7568 is a critical CSRF vulnerability in the brandondove Favicon Generator WordPress plugin versions up to 1.5. The vulnerability arises from missing or incorrect nonce validation in the output_sub_admin_page_0 function, enabling attackers to perform unauthorized file deletion via forged requests if an administrator is tricked into clicking a malicious link. The plugin author mitigated the risk by deleting the vulnerable functionality and closing the plugin, effectively patching the issue by discontinuation rather than a traditional update.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server by leveraging CSRF against site administrators. This can lead to complete compromise of affected WordPress sites, including loss of data integrity, availability, and potential further exploitation. The CVSS 3.1 score of 9.6 reflects critical impact with network attack vector, no privileges required, user interaction needed, and high confidentiality, integrity, and availability impacts.

The vulnerability has been mitigated by the plugin author deleting the vulnerable functionality and closing the plugin. Users should immediately discontinue use of the Favicon Generator plugin and replace it with a secure alternative. No patch or update is available since the plugin is closed. Patch status is effectively 'official-fix' by removal of the vulnerable code and plugin closure.