The WP Promoter plugin contains a missing or incorrect nonce check that allows a crafted request to be executed without authentication. An attacker can exploit this flaw by forcing an administrator to trigger a request that updates the plugin’s settings and injects malicious JavaScript. The injected script can execute in the context of the administrator’s session, enabling defacement, credential theft, or further compromise of the site. The vulnerability is identified as CWE‑352, describing a Cross‑Site Request Forgery condition.

All installations of WP Promoter by Rahul Bhangale running version 1.3 or older are affected. No specific patch version is listed, but the issue exists in all releases up to the 1.3 tag cited in the advisory.

The CVSS score of 6.1 indicates moderate severity. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires social engineering: the attacker must coerce a logged‑in site administrator to click a malicious link or submit a forged form. Because the flaw permits arbitrary setting changes, its impact can be widespread if the plugin is active on many sites, but it is limited to those with the vulnerable plugin and a privileged administrator.