Missing nonce verification in the plugin’s settings form allows an attacker who can trick an administrator into clicking a crafted link to submit forged requests. This upload of arbitrary data can change configuration options and inject malicious scripts that will run when the admin page is loaded, giving the attacker a foothold in the site’s privileged backend.

The vulnerability affects the Inquiry Cart WordPress plugin from Ravenster, specifically versions 3.4.2 and earlier. Site administrators using these older releases are at risk.

The CVSS score of 6.1 indicates a medium severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, implying it is not a widely exploited known vulnerability. Attackers need to lure an administrator into clicking a malicious link or inserting a forged form request, which is a commonly exploited CSRF pattern. Because the plugin stores the attacker’s payload, any subsequent interaction with the plugin’s admin pages will execute the injected code, potentially leading to full admin compromise.