CVE-2024-1214

CVE-2024-1214 describes a Cross-Site Request Forgery (CSRF) vulnerability in the Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress, affecting all versions up to and including 6.5.4. This flaw stems from inadequate nonce validation within the save_groups_list function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, leading to the disconnection of the site's Facebook or Instagram page/group connections. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in a low impact on integrity (data modification) but no impact on confidentiality or availability. The EPSS score is very low at 0.00102, suggesting a minimal likelihood of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also absent, which is typical for the vast majority of vulnerabilities.