The DirectoryPress Frontend plugin for WordPress contains a CSRF vulnerability due to improper nonce validation on the dpfl_listingStatusChange() function. This flaw enables attackers to perform unauthorized state-changing actions (updating listing statuses) by leveraging the trust of an authenticated administrator who interacts with a crafted request. The vulnerability affects all versions up to and including 2.7.9. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, no privileges required, and user interaction needed.

An attacker can cause an authenticated administrator to unknowingly update listing statuses via a forged request, potentially leading to unauthorized content changes on the affected WordPress site. There is no direct impact on confidentiality or availability reported. The impact is limited to integrity of listing status data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links and consider implementing additional CSRF protections or disabling the vulnerable functionality if possible.