The Torod shipping plugin contains a missing or incorrect nonce check in its save_settings routine, which lets an attacker send a forged request that will be processed as if it came from an authenticated administrator. Because the vulnerability does not require any credentials, an unauthenticated attacker can modify the plugin’s configuration by luring the site owner into clicking a crafted link.

All WordPress installations that use the Torod – The smart shipping and delivery portal for e‑shops and retailers plugin, with affected releases up to and including version 1.9. Versions 1.10 and later contain the fix.

The CVSS score of 4.3 places the flaw in the moderate category, while an EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a social‑engineering step to get the site administrator to trigger the vulnerable action, so the attack vector is remote but relies on a user interaction.