The Simple Crypto Shortcodes plugin contains an omission of nonce verification in its scs_backend function, which allows malicious actors to craft a request that a logged‑in administrator can unknowingly trigger. This enables the attacker to update the plugin’s settings without providing any credentials, thereby gaining control over how the shortcode behaves on the site. The underlying weakness is a classic CSRF flaw (CWE‑352).

WordPress sites running Simple Crypto Shortcodes versions up to and including 1.0.2 are affected. The vulnerability only impacts administrators who can submit the forged request, and it does not affect non‑administrator users directly.

The vulnerability carries a CVSS score of 4.3, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Exploitation requires the attacker to trick an administrator into clicking a link or submitting a form that targets the scs_backend endpoint. Because the flaw is a CSRF attack, it relies on user interaction and is not automatically exploitable from an external source.