The Vulnerable Plugin suffers from missing or insufficient nonce validation in the disconnect_account_action function, enabling an unauthenticated attacker to forge a request that, when a site administrator inadvertently clicks it, disconnects the site from the Opinion Stage platform. This denial of integration can render polls, surveys, and quizzes nonfunctional until re‑added, potentially disrupting user engagement and data collection. The weakness is a classic CSRF scenario (CWE-352).

WordPress sites using the Quiz, Poll & Survey Maker plugin by Opinion Stage with versions 19.12.0 and earlier are affected. The plugin integrates with the Opinion Stage platform and is installed as a standard WordPress plugin.

The CVSS score of 4.3 indicates a moderate risk, while the EPSS score of less than 1% signals a very low probability of exploitation at present. The vulnerability is not listed in CISA KEV, and no known active exploits have been reported. The likely attack vector is a malicious link or email that tricks a site administrator into visiting a crafted URL while logged into WordPress, thereby submitting a forged disconnect request.