The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross‑Site Request Forgery through an omission of nonce validation when a template configuration is updated. An unauthenticated attacker can cause an administrator to unintentionally add or delete template configuration entries by sending a forged request, such as a malicious link, that the admin follows. This change to configuration can alter how content is displayed or managed on the site without the admin’s consent.

The vulnerability affects the WordPress plugin "Disable Content Editor For Specific Template" produced by the vendor mynamevenu24, for all releases up to and including version 2.0. No other product versions are listed as affected.

The CVSS score of 4.3 categorizes this risk as moderate, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to entice an administrator into clicking a crafted URL or otherwise submitting a forged request, making the attack vector social‑engineering or phishing based. Based solely on the information provided, the exploitation can be carried out by an unauthenticated actor who successfully deceives an admin to trigger the template configuration update.