The CTL Arcade Lite plugin for WordPress contains a CSRF vulnerability that stems from missing or incorrect nonce validation on the 'ctl_arcade_lite_page_manage_games' page. This flaw allows an unauthenticated attacker to forge a request that activates or deactivates arbitrary plugins on the site, assuming the attacker can entice a site administrator to click a link or submit a form. If exploited, this gives the attacker control over plugin state, potentially disabling security measures or enabling malicious functionality and thereby impacting the integrity and availability of the WordPress installation.

WordPress sites running Codethislab's CTL Arcade Lite plugin, all releases up to and including version 1.0 are vulnerable. The attack applies to any configuration where the plugin is installed and the 'ctl_arcade_lite_page_manage_games' administration page is accessible to administrators.

The CVSS score of 4.3 indicates a moderate severity issue, but the EPSS score of less than 1 percent signals that real‑world exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. The attack requires the victim to be an authenticated administrator who is tricked into clicking a crafted link, making social engineering a critical component. While the path is straightforward once the administrator is deceived, the very low exploitation probability and lack of public exploits mean the risk is moderate but manageable with appropriate controls.