The Genzel Breadcrumbs WordPress plugin is vulnerable to Cross‑Site Request Forgery in all versions up to and including 1.2. The flaw arises from missing or incorrect nonce validation on the settings page, enabling an attacker to forge a request that updates the breadcrumb configuration. An attacker who tricks a logged‑in site administrator into clicking a malicious link could change the breadcrumb templates, delimiters, home label, home URI, and breadcrumb rules. This does not provide remote code execution but can alter site navigation and potentially hide malicious URLs or mislead users.

All installations of the Genzel Breadcrumbs plugin running version 1.2 or earlier are affected. No specific patch versions are listed for higher releases, but any update beyond 1.2 should resolve the vulnerability.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The likely attack vector is CSRF; an attacker must persuade an administrator to visit a crafted link while authenticated. No privileged escalation or remote code execution is required, but the impact on site configuration warrants timely remediation.