The vulnerability is a CSRF flaw in the RateMyAgent Official plugin for WordPress. The plugin’s rma‑settings‑wizard endpoint does not correctly validate or enforce nonces, allowing an attacker to trick an administrator into submitting a forged request that changes the plugin’s API key without authentication. If an attacker succeeds, the new key could grant them unauthorized access to services protected by that API key, potentially compromising sensitive data or allowing further exploitation. The weakness corresponds to CWE‑352.

All installations of the RateMyAgent Official plugin for WordPress up to, and including, version 1.4.0 are affected. The flaw pertains to the rma‑settings‑wizard functionality and exists in every release of the plugin prior to the change that introduced proper nonce validation.

The CVSS base score is 4.3 and the EPSS score is less than 1 %, indicating a moderate severity with a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires the attacker to entice a legitimate site administrator to click a crafted link or submit a forged form, which is feasible in a social‑engineering context. Once the API key is altered, the attacker can potentially use it to interact with the external service, undermining confidentiality in that ecosystem. Because the attack vector relies on CSRF, it is limited to the site where the admin logs in and does not require prior compromise of the server or the plugin code itself.