The Custom Login And Signup Widget plugin for WordPress contains a CSRF flaw caused by missing or incorrect nonce validation in the frndzk_adminclsw.php file. This allows an unauthenticated attacker to forge requests that alter a site administrator’s email and username settings. The impact is the unauthorized modification of domain‑level account information, which can compromise administrative control of the site. The weakness is classified as CWE‑352.

Vulnerable installations are all versions of the Bittokazi Custom Login And Signup Widget that are up to and including v1.0. No other versions are known to be affected.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to trick a site administrator into clicking a crafted link or submitting a malicious form, which then triggers the forged request to change the email and username settings. The requirement of a privileged user interaction keeps the attack surface limited, but once achieved it can lead to administrative takeover of the site.