The Quran Translations plugin for WordPress contains a CSRF weakness that permits unauthenticated attackers to submit forged POST requests to the plugin's settings page. Because the application lacks nonce verification, any request reaching the update_option() call will alter plugin options. An attacker could therefore flip controls such as PDF, RSS, podcast, media player links, or change the playlist title and code, effectively hijacking the public display configuration of the site.

This flaw affects the WordPress plugin Quran Translations, versions 1.7 and earlier. End‑users running any of those releases, especially administrators who have permission to modify the plugin’s configuration, are vulnerable. The issue exists only in the plugin code and does not impact core WordPress or other plugins.

The CVSS score of 4.3 indicates a medium severity threat, and the EPSS score is not publicly available. The vulnerability is not currently listed in CISA’s KEV catalog. Attackers need only craft a link or page that an administrator will click; no privileged credentials are required. If an administrator submits the forged request, the plugin settings will change at the site level, potentially exposing the site to further misuse or operational disruption.