The ViaAds WordPress plugin allows an unauthenticated user to perform a Cross‑Site Request Forgery against the ViaAds_pluginHandler function due to missing nonce validation. This flaw lets an attacker change the plugin's API key and cookie consent settings if an administrator clicks a forged request. The attack results in an unauthorized configuration change that could affect data transfer or tracking on the site.

The ViaAds plugin for WordPress, all releases up to and including version 2.1.2, is affected.

The CVSS score of 4.3 reflects a moderate risk, with exploitation requiring an attacker to convince an administrator to conduct a forged request. Because the EPSS score is less than 1%, the current probability of exploitation is low, and the vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must trick an admin into clicking a link to trigger the change.