The Latest Tabs plugin for WordPress suffers from a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation in the settings update handler located in admin-page.php. As a result, an attacker who can persuade a site administrator to click a malicious link can alter the plugin’s configuration settings without authentication. This weakness is classified under CWE‑352, indicating the vulnerability arises from insufficient request validation. The impact is limited to configuration changes, but such changes could indirectly affect site behaviour or enable further compromise if the plugin controls critical display functions.

Kentothemes’ Latest Tabs plugin is affected in all releases up to and including version 1.5. Users of any installation of this plugin that has not been updated beyond 1.5 are at risk.

The CVSS score of 4.3 reflects moderate severity, while the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, indicating it is not registered as a known actively exploited weakness. Exploitation requires an attacker to convince an administrator to visit a crafted URL; no elevated privileges or server-side access are needed for the attack to succeed.