The MetaMagic SEO Plugin, used in WordPress installations, fails to validate or incorrectly validates nonces when the metamagic_update_options function processes a request. As a result, unauthenticated users who can trick a site administrator into clicking a crafted link can modify the plugin’s configuration, such as enabling or disabling the plugin and turning on or off description and keyword meta tags. This behaviour can affect the visibility and search‑engine–relevance of a website and may also alter the site’s appearance or functionality if the plugin is disabled for a period.

The vulnerability applies to all releases of the MetaMagic SEO Plugin through version 1.6 and is referenced by the vendor identifier lhughes33472:MetaMagic SEO Plugin. WordPress sites that have installed the plugin within this version range are directly at risk.

With a CVSS score of 4.3 the flaw is considered moderate severity. The exploit does not require any authenticated access and can be carried out via a cross‑site request forgery. An attacker must lure a user with administrative privileges to load a malicious URL; once the request is submitted, the plugin settings are updated without further user consent. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation.