The vulnerability in the Bigfishgames Syndicate WordPress plugin permits a cross‑site request forgery attack through the bigfishgames_syndicate_submenu() function where nonce validation is missing or incorrect. An attacker who can convince a site administrator to click a malicious link can reset the plugin’s configuration and then update it with arbitrary values, potentially misconfiguring the plugin and compromising site functionality or security. The flaw does not provide direct code execution but can lead to indirect damage by changing settings in a way that may weaken site defenses or alter content.

WordPress sites running the Bigfishgames Syndicate plugin, versions 1.2 and earlier.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score is not available, while the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim administrator to perform an action such as clicking a link, which makes the attack vector an unauthenticated CSRF triggered by social engineering. Because the vulnerability only allows configuration changes, the impact is limited to the plugin but can still affect site security and functionality if the parameters are misconfigured.