CVE-2024-1213

CVE-2024-1213 is a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 6.5.4 of the Easy Social Feed – Social Photos Gallery – Post Feed – Like Box WordPress plugin. This flaw stems from inadequate nonce validation in the esf_insta_save_access_token and efbl_save_facebook_access_token functions. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to connect their Facebook and Instagram pages to the vulnerable WordPress site. The vulnerability has a CVSS score of 4.3 (MEDIUM), indicating a low attack complexity and no confidentiality or availability impact, but a potential for low integrity impact. The attack requires user interaction (UI:R) from an administrator. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.