The Peer Publish plugin suffers from a CSRF flaw due to missing nonce validation on its admin pages. When an attacker can lunge an authenticated administrator into clicking a crafted link, the admin can add, change, or delete website configuration settings without entering any credentials. This flaw enables an attacker to alter or destroy site setup information that could affect multiple hosted sites.

All installations of the Peer Publish WordPress plugin version 1.0 and earlier. The vulnerability resides in the website management admin pages accessed by site administrators.

With a CVSS score of 4.3, the flaw is classified as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not in the CISA KEV catalog. Exploitation requires that an administrator be tricked into executing a forged request while an authenticated session is active; otherwise, the request is rejected due to the absence of a nonce.