The vulnerability is a missing nonce check in the BMLT WordPress Satellite plugin's create and delete option actions. An attacker can forge a request that causes an authenticated site administrator to execute a request that creates or deletes plugin configuration values. This allows unauthenticated attackers to alter the plugin’s behavior, potentially leading to defacement, loss of functionality, or a sub‑optimal user experience. The weakness is identified as a Cross‑Site Request Forgery (CWE‑352).

magblogapi BMLT WordPress Satellite plugin version 3.11.4 and earlier are affected. All installations of this plugin up to and including 3.11.4 are vulnerable.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of < 1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker craft a forged request and obtain an administrator’s logged‑in session cookie, typically by tricking the administrator into clicking a malicious link. Because the attack relies on user interaction, the likelihood is modest, but the impact of changing or deleting settings could disrupt site operations or downgrade security, making remediation advisable.