The I Am Gloria WordPress plugin suffers from a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation in the iamgloria23_gloria_settings_page function. An attacker who can lure a site administrator into visiting a crafted link can reset the tenant ID, altering the site’s configuration without the administrator’s knowledge. This vulnerability does not expose data directly but compromises integrity by modifying stored configuration.

The plugin I Am Gloria, version 1.1.4 and earlier, is installed on WordPress sites. All installations of this plugin that have not been upgraded beyond 1.1.4 are vulnerable.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to trick an authenticated administrator into clicking a malicious link, so the attack vector is primarily internal exploitation of a trusted user session. If successful, the attacker could change the tenant ID but would not obtain broader administrative or system access.