The Homerunner plugin for WordPress contains a cross‑site request forgery flaw caused by missing or incorrect nonce validation in the main_settings() function. Because the plugin accepts configuration changes without verifying a valid authentication token, an unauthenticated attacker can forge a request that causes an administrator to unintentionally submit a settings update. The result is unauthorized modification of plugin configuration, which can alter site behavior or expose sensitive options. This weakness aligns with CWE-352.

The vulnerability is present in every release of the Homerunner plugin up to and including version 1.0.30. Any WordPress site that has installed these versions, provided by the vendor coolrunner, is affected. The attack surface is limited to the plugin’s settings page, but the impact can be felt across the entire WordPress installation if the changed settings influence core functionality or security.

The CVSS base score of 4.3 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog, further implying no widespread, weaponized use. Nevertheless, because the flaw requires a simple forged request and only an administrator’s interaction to succeed, a site that has the plugin active represents a moderate risk that should be addressed by applying the available fix promptly.