The wp Time Machine plugin for WordPress has a flaw that allows attackers to trick administrators into submitting forged requests because the core administration page does not verify the nonce correctly. The missing nonce validation permits an unauthenticated CSRF attack that can alter the plugin’s settings and inject malicious scripts into the site’s options table. Once the attacker’s script is stored, it runs in the context of any visitor or administrator, resulting in the potential to steal credentials, deface the site, or serve malware. This vulnerability is classified as a stored Cross‑Site Scripting (CWE‑79).

Products: WordPress plugin "wp Time Machine" created by Paulgpetty. All releases version 3.4.0 or earlier are affected. Any WordPress installation that has the plugin installed with these versions is vulnerable. The vulnerability is limited to the admin interface but impacts any site user that loads the page containing the stored malicious script.

The CVSS score of 6.1 indicates moderate severity, but the low EPSS score (<1%) suggests few public exploits exist currently. The vulnerability is not listed in CISA KEV, but it remains a significant risk because attackers could leverage social engineering to get an administrator to click a crafted link, thereby creating a persistent cross‑site scripting surface. Because no authentication is required to trigger the CSRF, the threat surface extends to all sites that have the plugin installed, making prompt remediation advisable.