The vulnerability occurs because the ContentStudio plugin for WordPress fails to validate a nonce in its add_cstu_settings function, enabling Cross‑Site Request Forgery. Unauthenticated attackers can forge a request that a site administrator might click, thereby altering plugin configuration without needing to log in. The weakness is identified as CWE‑352.

The issue affects the ContentStudio plugin for WordPress for all versions up to and including version 1.3.7. Users running these or older releases are vulnerable. No other products are listed as impacted.

The CVSS score of 4.3 indicates a medium severity and the EPSS score of less than 1% suggests a low probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Attackers can leverage this flaw by crafting a forged link that an administrator might click, thus exploiting the lack of nonce validation.