The Remove Post Type Slug plugin validates nonces with a logical OR instead of AND, so a request with an empty nonce field or a failed nonce check passes validation. This flaw allows an unauthenticated attacker to trick a logged‑in administrator into clicking a crafted link, causing the plugin’s post type slug removal settings to be altered without authorization. The vulnerability affects the integrity and availability of site configuration, potentially disrupting content handling for the affected WordPress installation.

The vulnerability is present in the WordPress plugin Remove Post Type Slug versions up to and including 1.0.2, distributed by akshayshah5189. WordPress sites that employ this plugin and have an administrator with network access are impacted.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. Attackers can exploit this vulnerability by posing as a trustworthy link to a site administrator, leveraging the plugin’s flawed nonce logic to modify settings after a single forged request.