The Rabbit Hole WordPress plugin suffers from a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation on its reset function. An attacker can craft a simple GET request, such as an image tag or hyperlink, that forces a logged‑in site administrator to reset the plugin’s configuration. The resulting action may compromise the site’s security posture or operation by restoring default settings, disabling monitoring features, or exposing sensitive data changes.

All installations of Rabbit Hole for WordPress with version 1.1 or earlier, distributed by frapesce. The vulnerability applies to any WordPress site that has this plugin active and an administrator accounts with resetting privileges.

With a CVSS score of 4.3 the flaw is considered low‑to‑moderate severity, but its exploitation is trivial because the malicious URL can be embedded in an image or link. The EPSS score is under 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the web (network) and requires an attacker to persuade a site administrator to click a crafted link. Once triggered, the reset is performed via a GET request, making the exploit straightforward but limited to the administrator’s session.