The vulnerability is a Cross‑Site Request Forgery on the "sertifier_settings" page caused by missing or incorrect nonce validation. An attacker can trick a logged‑in site administrator into clicking a crafted link or submitting a forged form, which then updates the plugin’s API key without the administrator’s consent. This change can be used to manipulate the plugin’s external communications or compromise data handled by the API.

The flaw affects the Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin distributed by Sertifier for any WordPress site that has a version of the plugin equal to or older than 1.19. The issue is limited to the settings page handling API key updates.

According to the CVSS score of 4.3 the vulnerability confers moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. Attackers need to target an authenticated administrator and rely on user interaction (for example, clicking a malicious link or loading a strategically placed iframe). Because the exploitation requires the admin’s browser session, it is considered a low‑to‑moderate threat for sites that do not employ additional CSRF defenses.