The Plugin updates blocker plugin for WordPress is vulnerable to Cross‑Site Request Forgery because the pub_save action handler does not perform proper nonce validation or performs it incorrectly. This allows an unauthenticated attacker to trick a logged‑in administrator into clicking a crafted link, which will cause the administrator’s session to execute the pub_save request and either enable or disable automatic plugin updates. The attacker can thus sabotage update processes or force updates to occur, impacting the maintenance and security posture of the site.

Affecting the WordPress plugin "Plugin updates blocker" developed by jegerwan. All releases up to and including version 0.2 are vulnerable.

The CVSS v3.1 score of 4.3 indicates moderate risk, and the EPSS score of <1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is a CSRF request that an attacker can embed in a link or form, requiring the administrator to click or submit something while authenticated. The attack does not require any privilege escalation beyond being able to convince the target to perform the action.