The Pearl – Header Builder plugin for WordPress contains a CSRF vulnerability (CWE-352) due to improper or missing nonce validation on the stm_header_builder page. This flaw permits unauthenticated attackers to craft requests that, when executed by an authenticated site administrator, can delete arbitrary headers. The vulnerability affects all plugin versions up to 1.3.8. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor as of the publication date.

Successful exploitation allows an attacker to cause an authenticated administrator to delete arbitrary headers via a forged request. This could lead to unintended configuration changes in the header builder settings, potentially impacting site behavior or security posture. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links or requests that could trigger header modifications. Monitoring for updates from the vendor or plugin maintainers is recommended.