The vulnerability allows unauthenticated attackers to submit forged requests that bypass security checks, enabling them to alter every setting in the TextP2P Texting Widget. By changing titles, messages, API credentials, colors, or reCAPTCHA configuration, an attacker can effectively re‑brand the widget, divert users, or send messages through compromised credentials. The attack hinges on the absence of a nonce validation in the settings update routine, which creates a classic CSRF fault (CWE‑352).

TextP2P Texting Widget for WordPress; all releases up to and including version 1.7 are affected. The issue appears in the plugin's options administration page. No specific sub‑versions are listed, so any deployment of 1.0 up to 1.7 is vulnerable.

The CVSS score of 4.3 indicates moderate risk. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, suggesting exploitation, if it occurs, may be limited or not yet observed. An attacker only needs to lure an administrator into executing a crafted link or form; authentication is not required. The risk of social‑engineering exploitation remains, but the lack of a formal exploit or widespread reports keeps the practical threat moderate.