CVE-2024-0660 is a Cross-Site Request Forgery (CSRF) vulnerability in the Formidable Forms WordPress plugin. This flaw allows unauthenticated attackers to potentially modify form settings and inject malicious JavaScript code. The vulnerability exists due to missing or incorrect nonce validation in the update_settings function of the plugin.

Attackers can exploit this by tricking a site administrator into clicking a malicious link, leading to unauthorized changes in the plugin's configuration. Despite the relatively low CVSS score of 4.3, the potential for injecting malicious JavaScript makes it a significant risk. With a SOCRadar Vulnerability Risk Score (SVRS) of 30, the risk is deemed moderate, but remediation should still be considered to prevent potential compromise. This vulnerability underscores the importance of proper input validation and CSRF protection in WordPress plugins. Successful exploitation could lead to website defacement, data theft, or even complete site takeover.