The LEAV Last Email Address Validator plugin for WordPress contains a flaw in the display_settings_page function where nonce verification is missing or incorrect. This defect enables a Cross‑Site Request Forgery attack, allowing an unauthenticated user to trick an administrator into submitting a forged request that changes plugin settings. The resulting compromise can alter configuration parameters without authorization, potentially impacting site behavior and user data handling.

This vulnerability affects the LEAV Last Email Address Validator plugin, version 1.7.1 and earlier, used on WordPress installations. If the plugin is present and enabled, any site where administrators log in may be exposed.

The CVSS score is 4.3, indicating moderate impact. The EPSS score is below 1%, suggesting a low likelihood of exploitation in current data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an unauthenticated attacker sends a crafted link to a site administrator, who upon clicking would trigger the CSRF and update settings; no authentication or authorization checks are present, making the exploit straightforward when an admin is lured.