The Publish approval WordPress plugin is vulnerable to CSRF due to missing or incorrect nonce validation in the publish_save_option function. An unauthenticated attacker can forge a request that an administrator will unknowingly submit, enabling the attacker to alter plugin configuration. Because these settings govern how content is published, the vulnerability allows a malicious actor to disrupt or manipulate the publishing process.

Evidentlycube Publish approval plugin for WordPress, any version up to and including 1.1. All installations using these versions lack the proper nonce check on settings changes and are therefore vulnerable until addressed.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a very low current likelihood of exploitation, and the issue is not listed in CISA’s KEV catalogue. Exploitation requires an attacker to convince a site administrator to click a link or submit a crafted form, after which the attacker can modify settings with administrator privileges. The impact therefore is confined to administrators who can change publishing workflow configuration, but those changes can affect the entire site.