The Bitcoin Donate Button plugin for WordPress has a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation on its settings page. An attacker who can trick a site administrator into clicking a crafted link can forge a request that alters the plugin’s configuration, such as changing donation addresses or display options. This compromises the integrity of the donation process and can lead to financial loss by redirecting funds to attacker‑controlled addresses.

All installations of the Bitcoin Donate Button plugin up to and including version 1.0 from the vendor lxicon are affected. The vulnerability is present in every version up to the 1.0 release; no later versions are documented as affected.

The CVSS base score is 4.3, indicating a moderate severity. The EPSS score is less than 1 %, implying a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely local with a need for the administrator to click a malicious link; the attacker does not need to be authenticated but requires social engineering of an admin. The risk is moderate, with potential for financial damage if an attacker can reconfigure payment addresses.