The Notify Odoo plugin for WordPress allows unauthenticated attackers to change the plugin URL, notification settings, tracking image URL, and allowed IP addresses by POSTing to the _updateSettings endpoint. Because the endpoint lacks proper nonce validation, a malicious request can be crafted and executed by tricking a site administrator into clicking a link, leading to unauthorized configuration changes that can redirect notifications or expose sensitive data. This vulnerability represents a typical CSRF weakness (CWE‑352).

All installations of the Notify Odoo plugin from its introduction up to and including version 1.0.1 are vulnerable. The affected product is the Notify Odoo WordPress plugin maintained by pektsekye. Users running any of these versions are exposed to the flaw.

The CVSS score of 4.3 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting current exploitation activity is low. The likely attack vector is a forged request sent to the administrator’s browser; the attacker must initially lures an admin user into executing a malicious link, after which the request updates sensitive settings without prior authorization.