The TITLE ANIMATOR plugin for WordPress contains a Cross‑Site Request Forgery flaw that removes nonce validation from its settings page. This deficiency permits an attacker who can persuade a site administrator to click a crafted link to alter any of the plugin's configuration options. Although the change does not grant arbitrary code execution, it can modify visible site features or weaken security posture by enabling malicious options.

The vulnerability exists in all releases of the TITLE ANIMATOR plugin by arkapravamajumder up to and including version 1.0. No further version details are publicly listed.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% suggests exploitation probability is very low. The flaw is not listed in CISA’s KEV catalog. Attackers must first coerce a logged‑in administrator into performing an action that submits the forged request; no privileged access or network compromise is required. Once the CSRF attack succeeds, the attacker can change settings until the plugin is updated or the flaw is mitigated.