The Bunny’s Print CSS plugin for WordPress contains a Cross‑Site Request Forgery flaw that originates from missing or incorrect nonce validation in the pcss_options_subpanel() function. Because an unauthenticated attacker can send a forged request that updates the plugin’s configuration, the settings menu can be altered without the admin’s knowledge. The impact is the unauthorized modification of the plugin’s printing settings, which may change how content is rendered for end users.

All installations of Bunny’s Print CSS with a version equal to or lower than 0.95 on a WordPress site are affected. The vulnerability is limited to sites that have the plugin deployed and is not a problem for WordPress core or other plugins.

The CVSS base score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely in the short term. The issue is not listed in the CISA KEV catalog, meaning no public exploit has been confirmed. Attackers would need to convince a site administrator to click a crafted link or otherwise trigger the CSRF request. The risk level remains moderate in the absence of a known exploit, but awareness is advisable.