The CDN Linker lite plugin for WordPress contains a missing or incorrect nonce validation in the ossdl_off_options() function. This flaw allows attackers to perform Cross‑Site Request Forgery against unauthenticated users who have administrator privileges. By sending a forged request, an attacker can change the plugin’s configuration, most notably the CDN URL that rewrites all static asset references on the site, thereby potentially redirecting traffic to malicious resources or causing a break in asset delivery.

This vulnerability affects all installations of the CDN Linker lite plugin version 1.3.1 or earlier on WordPress sites. Any site that has plugged in the CVE‑affected version and relies on it for static asset rewriting is at risk until the plugin is updated.

The CVSS score of 4.3 indicates a moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is most likely social engineering where an attacker hosts a malicious link that an administrator clicks while logged into WordPress. Successful exploitation requires the target to be an administrator with the ability to update plugin settings, and the attacker can then modify the CDN URL without any authentication beyond the nonce check.