The imwptip WordPress plugin contains a Cross‑Site Request Forgery vulnerability that allows an unauthenticated attacker to modify the plugin’s settings when a site administrator inadvertently submits a forged request. The flaw is caused by missing nonce validation on the settings update functionality, meaning that any user who can trick an administrator into clicking a link or submitting a form could change configuration values. These changes could leak sensitive data, change the way the plugin behaves, or otherwise give the attacker functional influence over the site’s operation.

The vulnerability affects all releases of the imwptip plugin up to and including version 1.1, as distributed by the plugin author hu_chao.

With a CVSS score of 4.3 the risk is moderate. The EPSS score of less than 1% indicates an extremely low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is provided by a CSRF request – an attacker does not need authentication but must persuade an administrator to perform a state‑changing action, such as clicking a link. Because the flaw involves an unauthenticated CSRF vector, the feasibility is high for an attacker able to send crafted requests to the target site.