CVE-2024-3474 is a cross-site request forgery flaw in the Wow Skype Buttons WordPress plugin before 4.0.4, rated High (CVSS 8.8) in the NVD record. It is fixed in 4.0.4. Update the plugin, or remove it if it has no use on your site.
What's affected
The record and WPScan both say versions before 4.0.4 are affected, and WPScan lists 4.0.4 as the fixed version. The plugin's folder name is mwp-skype. The weakness is CWE-352 (cross-site request forgery). The CVSS vector in the record says the attack is reached over the network, with low attack complexity, needing no privileges and some user interaction.
The description says some bulk actions lack CSRF checks, so an attacker could make a logged in admin perform unwanted actions, such as deleting buttons. The user has to be tricked into loading a page while logged in as admin.
Source conflict on severity: the NVD record gives CVSS 8.8 (High, with a high impact on confidentiality, integrity and availability), while WPScan rates it 4.3 (medium). The practical impact described, deleting buttons, matches a lower rating, so treat the NVD number with care. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
How to check if you're exposed
If you have WP-CLI, list the plugin and its version on each site.
wp plugin list --name=mwp-skype --fields=name,status,version
If the command returns a version below 4.0.4, update it. If it returns nothing, the plugin is not installed under that folder name. You can also check the Plugins page in the WordPress admin. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- List WordPress sites you run and check for the mwp-skype plugin.
- Update Wow Skype Buttons to 4.0.4 or later, or remove it.
- Ask admins to log out of WordPress before browsing other sites, and to avoid opening links from unknown sources while logged in.
- Review the plugin list for other abandoned or unused plugins and remove them.
Why it matters
Cross-site request forgery works because a browser sends a user's logged in cookies with every request to a site, even one triggered from another web page. If an admin action does not carry a secret token that proves the request came from the real admin page, a hostile page can submit it on the admin's behalf. WordPress gives developers nonces for this, and the plugin skipped them on some bulk actions.
The fix is small, and so is the exposure for most sites. Still, small unused plugins are a common source of trouble, and deleting what you do not use is the cheapest control. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which score should I use, 8.8 or 4.3?
Both appear in the sources. The impact described is deleting buttons, which fits the lower WPScan rating, but the NVD number is the one most scanners show. Update the plugin either way.
Sources
Last reviewed: 19 October 2026.
