The WP Global Screen Options plugin has a missing nonce check in its administrative action handler, which allows an unauthenticated attacker to send a forged request that changes the global screen options for every user. The change does not reveal sensitive data but can alter the user interface and workflow for all administrators and site users. The weakness is a Cross‑Site Request Forgery flaw, identified as CWE‑352.

WordPress sites that have the WP Global Screen Options plugin by stiand installed, versions 0.2 and earlier are affected.

The CVSS score of 4.3 indicates moderate severity and the EPSS score is below 1%, pointing to a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to lure an administrator into clicking a crafted link or submitting a form that triggers the vulnerable action; no administrator credentials are required, but the attack relies on user interaction. The likely attack vector involves an administrator clicking a malicious link, which is inferred from the description. Because the impact is limited to interface configuration and does not grant direct data access or code execution, the overall risk is moderate but warrants timely remediation.