The Top Friends plugin for WordPress contains a Cross‑Site Request Forgery vulnerability in all releases up to and including version 0.3. The flaw stems from missing nonce validation in the top_friends_options_subpanel() function, which allows an unauthenticated attacker to send a forged request that will be accepted by the plugin. Because the affected function updates plugin options, a successful exploit can silently change configuration values that may alter site behavior, compromise user data, or enable other downstream attacks. The weakness is identified as CWE-352, a classic CSRF flaw.

All WordPress sites that have the Top Friends plugin installed – specifically any version up to and including 0.3. The plugin is distributed by the author denishua and is included in the official WordPress plugin repository.

The CVSS score of 4.3 places this vulnerability in the moderate severity range. The EPSS score of less than 1% indicates that active exploitation is currently very unlikely. The vulnerability is not listed in the CISA KEV catalog, so no known exploits are publicly documented at this time. The likely attack vector is an unauthenticated attacker crafting a malicious link that an unsuspecting site administrator clicks, triggering the forged POST or GET request to the plugin's settings page. Because the request bypasses nonce checks, the settings can be altered without detection.