The WP SinoType plugin for WordPress is affected by a Cross‑Site Request Forgery vulnerability that originates from missing or incorrect nonce validation in the sinotype_config function. This flaw allows an attacker who can lure the site administrator into clicking a malicious link or URL to change typography settings on the site without authentication. The impact is that the attacker can modify appearance parameters, potentially defacing the site or embedding malicious styles, although the attack does not provide direct code execution or data exfiltration capability.

Affected installations are WordPress sites running the WP SinoType plugin version 1.0 or older. The plugin is maintained by samueljesse and is identified by the vendor/product name WP SinoType. No other products or versions are listed as affected.

The CVSS score of 4.3 indicates a low to moderate risk, and the EPSS score of less than 1 % suggests a very low probability of exploitation at this time. The vulnerability is not included in CISA’s KEV catalog. Exploitation requires user interaction: the admin must navigate to a forged URL or click a link that submits the unfettered request. Because the flaw can be triggered by unauthenticated individuals who successfully trick an administrator, the operational risk is limited but should be mitigated promptly.