The Advanced Database Cleaner plugin for WordPress contains a Cross‑Site Request Forgery flaw that lets an attacker modify the "keep last" configuration by influencing an administrator to click a malicious link. The weakness arises from missing or incorrect nonce validation in the aDBc_prepare_elements_to_clean() function, a classic input validation problem (CWE‑20).

The plugin is developed by symptote and is called "Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance". All releases up to and including version 3.1.6 are vulnerable, while version 3.1.7 and later contain the fix.

The CVSS base score of 4.3 indicates a moderate impact; the EPSS score is less than 1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to supply a forged request to the vulnerable function, and the attack relies on a victim administrator performing a legitimate action, typically clicking a crafted link. Because the flaw permits configuration changes, an attacker could manipulate database cleaning settings, potentially leading to unintended data removal or performance issues if the settings were altered from their intended state.