The vulnerability resides in the AdminQuickbar plugin for WordPress. Missing or incorrect nonce validation on the 'saveSettings' and 'renamePost' AJAX actions allows an attacker to submit forged requests. An unauthenticated adversary can trick a site administrator into clicking a malicious link, leading that administrator’s authenticated session to execute the action. The result is that the plugin’s configuration can be changed at will and post titles can be updated without authorization, undermining the integrity of the site’s content and settings.

WordPress sites that have the AdminQuickbar plugin version 1.9.3 or earlier are affected. The plugin is distributed by rtowebsites and is used as an add‑on to WordPress installations.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread active exploitation. An attacker would need to engage in social engineering to obtain an administrator to initiate the forged request, but once successful the attacker gains non‑privileged control over critical site configuration and content.