This vulnerability arises from a missing or incorrect nonce validation on the 'abundatrade' page of the Abundatrade WordPress plugin, allowing an unauthenticated attacker to forge a request and modify the plugin's settings. By injecting malicious scripts through the forgery, the attacker can store cross‑site scripting code that will execute in the context of an administrator who later visits the site. The weakness is classified as CWE‑352, which represents improper or missing validation of intended authorization. Because the redirected script runs with the privileges of the site admin, an attacker can hijack sessions, deface the site, or exfiltrate sensitive content.

The plugin is distributed by withinboredom and is available on the WordPress plugin repository. Versions up to and including 1.8.02 are affected. The vulnerability is specific to the Abundatrade Plugin within WordPress installations that have the plugin activated. No other WordPress core components are impacted.

The CVSS score of 6.1 denotes a moderate severity. EPSS < 1% indicates the likelihood of exploitation is very low at present, and the vulnerability has not been listed in the CISA KEV catalog. The attack requires a social engineering step; the attacker must supply a crafted link to a site administrator who then clicks it, triggering the CSRF request. Because the vulnerable action runs as an authenticated administrator, the impact of successful exploitation is high, underlining the importance of timely remediation.