This vulnerability arises from missing or incorrect nonce validation in the TopBar plugin’s settings save function. Because a nonce is not checked, an attacker can construct a forged request that, when performed by a site administrator, changes the plugin’s configuration. The flaw is a classic CSRF weakness identified as CWE‑352 and permits modification of configuration without authentication.

The issue exists in all releases of the TopBar WordPress plugin up to and including version 1.0.0, distributed under the fmeaddons TopBar package. No other vendors or products are listed as affected.

The CVSS score of 4.3 places the vulnerability in the low to moderate range, while the EPSS score of <1% indicates a very low probability of exploitation. The attack requires an unauthenticated attacker to coerce an administrator into visiting a crafted link or form, making it a social‑engineering type threat. The vulnerability is not listed in CISA’s KEV catalog.