The GoStats for WordPress plugin contains a cross‑site request forgery flaw caused by missing or incorrect nonce validation in the gostats_manage() function. An attacker can send a forged request that an administrator may unknowingly execute, allowing the attacker to modify the plugin's configuration options such as gostats_siteid and gostats_server. This can alter how the plugin reports statistics, potentially redirecting data to malicious endpoints or disrupting site operations.

All users of the rchmura GoStats for WordPress plugin with versions up to and including 1.4 are affected. The vulnerability applies to any WordPress installation that has this plugin installed and has not upgraded beyond 1.4.

The issue has a CVSS score of 4.3, indicating a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a malicious link or form that submits to the plugin's management endpoint. Successful exploitation requires an administrator to click the link or submit the form, after which the plugin settings are changed without authentication.