The WpMobi plugin for WordPress is vulnerable to Cross‑Site Request Forgery in all versions up to including 0.0.3. The flaw stems from missing or incorrect nonce validation in the handleSaveGeneralSettings function, allowing an unauthenticated attacker to submit a forged request that changes the plugin’s General Settings. In particular, the attacker can inject arbitrary JavaScript into the administrator’s browser through the insecure app_name attribute that is reflected without proper escaping when validation fails. If the target site’s administrator clicks a malicious link or submits a crafted form, the injected script executes immediately, potentially providing the attacker with persistent access to the admin session. The vulnerability is a classic example of CWE‑352, where request integrity is not verified. The impact is limited to modifying plugin settings and injecting temporary scripts; the changes are not persisted to the database, but the immediate execution can grant the attacker unauthenticated control over the admin interface during the session. Because the flaw does not require any initial authentication and can be triggered via a simple crafted link, the risk is moderate with a CVSS score of 4.3. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Nonetheless, the attack vector of CSRF makes it easy for malicious actors to target any WordPress site running an affected version of WpMobi.

Affected systems are WordPress sites that run the WpMobi plugin version 0.0.3 or earlier, developed by rahulbhangale. The vulnerability impacts administrators who have access to the General Settings page of the plugin.

The CVSS score of 4.3 indicates a moderate severity, while the lack of an EPSS score and absence from the KEV catalog suggest limited public exploitation at the time of analysis. Nonetheless, the CSRF nature of the flaw allows unauthenticated attackers to craft a link or form that, when clicked by an administrator, modifies settings and injects transient JavaScript into the admin interface—enabling temporary compromise of the admin session without persistence to the database.