The vulnerability arises from missing or incorrect nonce validation in the plugin's 'custom_plugin_set_option' function. This flaw allows an unauthenticated attacker, by tricking an administrator into visiting a crafted URL, to modify any plugin option on the site. By changing the default registration role to administrator and enabling user registration, an attacker can create an administrative account and gain full control of the WordPress installation.

All releases of the Insert Headers And Footers plugin up to and including version 3.1.1 are affected. The plugin is distributed by hiddenpearls under the name Insert Headers And Footers for WordPress and should be upgraded to the latest version that fixes the CSRF flaw.

The flaw carries a CVSS score of 7.5 and an EPSS score below 1 percent, indicating moderate severity with a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the site has the WPBRIGADE_SDK__DEV_MODE constant set to true and that an administrator clicks a malicious link that submits an unauthorized request to the 'custom_plugin_set_option' endpoint. Successful exploitation can lead to privilege escalation by creating an attacker-controlled administrator account.