The MotorDesk WordPress plugin suffers from a missing nonce validation in the motordesk_admin_home function, which permits an unauthenticated attacker to craft a forged HTTP request that an administrator can unknowingly submit. By doing so, the attacker can modify the plugin’s configuration settings, including the search page URI and the custom template directory path, without any form of authentication or authorization.

Affected installations are those running MotorDesk plugin version 1.1.2 or earlier on any WordPress site. This includes all public or private servers where the plugin is active, with the vulnerability present in every code path that processes the admin home settings page.

The CVSS base score is 4.3, indicating moderate risk. The EPSS score is not reported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. The attack vector is a typical CSRF scenario that requires an administrator to interact with a crafted link or form; thus, the attacker gains only configuration‑level privileges, but these changes can be leveraged for defacement, redirect, or further compromise.