The Reuters Direct plugin for WordPress suffers from a missing or incorrectly implemented nonce check on its settings page, enabling a cross‑site request forgery attack. An unauthenticated attacker can craft a forged request that, when a site administrator clicks a link or performs an action, forces the plugin to reset its configuration to defaults. This vulnerability does not allow code execution but can lead to unintended configuration changes that may impair the site’s functionality.

The vulnerability affects all versions of the Reuters Direct plugin for WordPress up to and including 3.0.0.

The CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve social engineering whereby an attacker induces an administrator to click a malicious link; this requires the target to be logged into the admin interface and does not require any additional privileges.