The Optimize More! – CSS plugin is vulnerable to Cross‑Site Request Forgery because the reset_plugin function does not perform correct nonce validation. An attacker who can trick a WordPress site administrator into clicking a crafted link can cause the plugin’s optimization settings to be reset to their defaults. This results in configuration tampering that can degrade site performance and potentially expose the site to further misconfiguration attacks. The weakness is a classic Cross‑Site Request Forgery flaw (CWE‑352).

WordPress sites running the Optimize More! – CSS plugin, version 1.0.3 or earlier. Any WordPress installation that has installed this plugin and has an administrator account that can be social‑engineered is at risk.

The CVSS score of 4.3 reflects a moderate severity. The EPSS score of less than 1% shows a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to obtain administrative interaction, typically through a phishing or social‑engineering vector directed at a site administrator. Once the admin executes the forged request, the plugin’s settings are reset, which is a non‑destructive but disruptive change that may lead to increased resource usage or other indirect impacts.