The Simcast WordPress plugin contains a Cross‑Site Request Forgery flaw in all releases up to and including 1.0.0, caused by missing or incorrect nonce validation in the settingsPage function. This flaw permits an unauthenticated attacker to send a forged request that, when executed by a logged‑in administrator, will change the plugin’s configuration settings. The attacker can influence any setting exposed by the plugin, potentially degrading site security or functionality.

All WordPress sites that have the openchamp:Simcast plugin installed with a version 1.0.0 or earlier. The vulnerability is tied directly to the plugin’s settings management code and does not involve other components of WordPress.

The vulnerability scores a CVSS of 4.3, indicating moderate severity, and its EPSS score is less than 1%, suggesting a low probability of exploitation in the current environment. It is not listed in the CISA KEV catalog. Attackers would need to trick an administrator into clicking a malicious link or submitting a forged form, as the exploit relies on a CSRF vector rather than direct remote code execution.