The HQ Rental Software WordPress plugin suffers from a CSRF vulnerability due to improper or missing nonce validation in the displaySettingsPage() function. This flaw enables attackers to craft forged requests that, when executed by an authenticated administrator, can update arbitrary plugin options. Such unauthorized changes may be leveraged to escalate privileges within the affected WordPress environment. The vulnerability affects all versions up to and including 1.5.29. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to perform unauthorized updates to plugin options by tricking an administrator into executing a malicious request. This can lead to privilege escalation and compromise of the affected WordPress site’s confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger changes in the HQ Rental Software plugin settings. Monitoring vendor channels for updates is recommended.