The Bottom Bar plugin for WordPress is affected by a Cross‑Site Request Forgery flaw that allows an attacker to modify plugin settings without authentication. By sending a crafted POST request to the plugin’s admin forms, an attacker can change configuration options such as language, post display limits, or sharing services. This can undermine site behavior and user experience, potentially revealing internal data or enabling further manipulation of the site’s front‑end.

WordPress sites running the Bottom Bar plugin version 0.1.7 or earlier are vulnerable. The issue appears in all forms handled by bottom-bar-admin.php and affects the main settings, sharing services, and restore defaults pages of the plugin.

The CVSS score of 4.3 indicates moderate severity. The flaw is exploitable by an unauthenticated attacker who can trick a logged‑in administrator into executing the malicious request, so it is likely to be used against sites with exposed admin URLs. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Implementation requires only a forged HTTP POST, and no special privileges or environment is needed beyond the ability to reach the site’s admin interface.