The Page Blocks plugin for WordPress has a CSRF flaw in the admin_process_widget_page_change function because nonce validation is missing or incorrect. The weakness lets an unauthenticated attacker submit a forged request that an administrator will accept if the admin follows a malicious link. By doing so, attackers can alter widget page block configurations, potentially changing the site’s appearance or functionality. The vulnerability is mapped to CWE‑352.

Any WordPress installation that uses Page Blocks version 1.1.0 or earlier is affected. The plugin is commonly employed to manage layout blocks, so administrators who have not upgraded are at risk.

The CVSS score of 4.3 indicates a moderate severity. An EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV. Exploitation requires only that an administrator unknowingly click a crafted link while authenticated; an attacker needs no special technical access beyond the admin’s session token. The flaw stems from the plugin’s failure to verify the required nonce.