The SocialChamp plugin for WordPress contains a missing nonce check in the wpsc_settings_tab_menu function, enabling attackers to forge authenticated requests. A forged request can alter plugin settings on a site where an administrator is logged in, potentially redirecting social media postings or changing connected accounts. This flaw violates integrity by allowing unauthenticated users to modify configuration controls. The impact is limited to the plugin’s functionality and could result in unintended content posts or misconfigured social media feeds.

The vulnerability affects the SocialChamp Auto Post to Social Media from Social Champ plugin, all releases up to and including version 1.3.5. End‑users running any WordPress version with the plugin installed are potentially impacted if they are administrators or other privileged roles.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of < 1% reflects a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires social‑engineering: an attacker must convince an authenticated administrator to click a malicious link that submits a forged POST request containing parameters to the plugin’s settings endpoint. No additional access or privilege escalation is required beyond the victim’s authenticated session.