The WP Plugin Info Card plugin for WordPress is vulnerable to Cross‑Site Request Forgery from missing nonce validation in its ajax_save_custom_plugin() function. An unauthenticated attacker can forge an admin request to create or modify custom plugin entries, inserting arbitrary data that will be displayed to site visitors. This can be used to deface content, embed malicious links, or mislead users, compromising the integrity and trust of the site.

Affected product: WP Plugin Info Card by brikou. Versions 6.2.0 and earlier are vulnerable. The issue arises in the PHP admin component of the plugin.

The CVSS score is 4.3 (medium) and the EPSS score is less than 1%, indicating a low likelihood of widespread exploitation. The vulnerability is not listed in the KEV catalog. The attack requires an administrator to be logged in and to click a crafted link; the CSRF nature means that the vulnerability is exploitable via a simple link, so mitigation is straightforward. No known public exploit appears to be available, but the low EPSS does not eliminate risk.