The vulnerability stems from missing or incorrect nonce validation on the ithoughts_ace_update_options AJAX action in the iThoughts Advanced Code Editor WordPress plugin. Because of this omission, an attacker does not need credentials to change plugin configuration. By tricking an administrator into clicking a crafted link or otherwise making a forged request, the attacker can modify settings that may affect code editing behavior, security features, or plugin functionality.

All installations of iThoughts Advanced Code Editor version 1.2.10 or earlier, sourced from the Gerkin vendor. The affected component is the settings update endpoint handled by the plugin within a WordPress site.

The CVSS score of 4.3 places the vulnerability in the moderate severity range, and the EPSS score of less than 1% indicates a very low probability of exploitation in the broader ecosystem. The vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. This CSRF flaw requires social engineering or a pre‑existing malicious link to persuade an administrator to execute a forged request, making exploitation user‑dependent and less likely to spread automatically.