The FunKItools WordPress plugin suffers from a Cross‑Site Request Forgery flaw that allows an attacker who convinces an administrator to click a crafted link to alter the plugin’s configuration. The weakness stems from missing or incorrect nonce validation in the saveFields() function, letting unauthenticated requests update settings. This does not provide code execution or data theft but can modify site behavior, potentially enabling further exploitation or disrupting functionality.

All FunKItools WordPress plugin versions up to and including 1.0.2, distributed by flenskiproject, are impacted. Sites running any of these versions must inspect their plugin settings for unintentional changes and apply mitigations.

With a CVSS score of 4.3 this vulnerability is considered moderate. The EPSS score is below 1%, indicating a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Attackers need only social engineering to have a logged‑in administrator perform a forged request; no additional technical barriers are required.