The WordPress plugin WP Status Notifier allows unauthenticated attackers to alter its settings because the update functionality does not validate the required nonce. This flaw lets any attacker who can coerce a site administrator into visiting a crafted link perform a successful change to the plugin’s configuration. The primary consequence is the compromise of the site’s configuration, potentially exposing sensitive information or enabling further attacks, but it does not directly provide remote code execution or other higher‑level privileges.

The vulnerability affects all releases of the WP Status Notifier plug‑in up to and including version 1.0. The affected product is the WP Status Notifier plug‑in for WordPress, developed by fulippo. Users running WordPress sites with this plug‑in installed and configured are at risk.

The CVSS rating of 4.3 indicates a moderate impact, while the EPSS score of less than 1 % shows that the probability of exploitation is currently very low. The flaw is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to persuade a logged‑in administrator to click a malicious link or perform a forged request, after which the plug‑in settings are altered without any additional privileges.