The OPEN‑BRAIN plugin for WordPress contains a flaw where the settings form in the func_page_main() function does not perform nonce verification. This flaw allows an attacker who is not authenticated to forge a request that will be executed in the context of any logged‑in administrator who follows the attacker’s link. The attacker can therefore inject malicious scripts or alter the site’s configuration without requiring any credentials. The weakness is a classic CSRF vulnerability, identified by CWE‑352.

WordPress installations running the OPEN‑BRAIN plugin by faridsaniee with a version of 0.5.0 or earlier are vulnerable. Versions newer than 0.5.0 have removed the missing nonce check and are not affected.

The CVSS score of 6.1 indicates the vulnerability has moderate severity. No EPSS score is available, so a precise exploitation probability cannot be quantified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only that an attacker craft a malicious request and plant it in a link or email that an administrator will click; once the administrator follows that link, the request is processed with their elevated privileges. Because the attacker does not need to log in, the risk to site integrity and availability is considerable, though the overall likelihood of exploitation depends on the administrator’s susceptibility to social engineering.