The Index Now WordPress plugin (CrawlWP SEO – Instant Search Engine Indexing & SEO Performance Monitor) suffers from a CSRF vulnerability (CWE-352) due to improper or missing nonce validation in the 'reset_form' function. This allows attackers to craft malicious requests that, when executed by an authenticated administrator, can delete arbitrary site options. The vulnerability affects all versions up to 2.6.3 and does not require prior authentication to exploit, relying instead on social engineering to induce administrator interaction. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation can lead to deletion of arbitrary site options, which may disrupt site functionality or availability. There is no direct confidentiality impact reported. The attack requires tricking an administrator into performing an action, such as clicking a malicious link, which means social engineering is a component of the attack vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking on unsolicited links and consider restricting administrative access or implementing additional CSRF protections at the web server or application level. Monitoring for updates from the vendor properfraction is recommended to apply any forthcoming patches promptly.