The Coding Blocks plugin for WordPress is vulnerable to CSRF because it omits nonce validation when updating settings. An attacker who tricks a site administrator into clicking a crafted link can change any plugin configuration, including theme parameters, without authentication. This flaw corresponds to CWE‑352 and enables an unauthenticated user to modify settings that may influence the site’s appearance and behavior.

WordPress sites running the Coding Blocks plugin version 1.1.0 or earlier from the vendor Octagonsimon. All affected installations are susceptible to the CSRF flaw until the plugin is upgraded beyond 1.1.0.

The CVSS score of 4.3 rates the flaw as medium severity, while the EPSS score of less than 1% indicates a very low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack requires an authenticated administrator to click a malicious link; thus, active attackers need only social engineering rather than technical compromise. Even so, site owners should treat the vulnerability as a risk to configuration integrity.