The WP Legal Pages plugin for WordPress, specifically the Privacy Policy Generator – WPLP Legal Pages component, contains a CSRF vulnerability (CWE-352) in versions up to 3.2.6. This vulnerability is due to missing or incorrect nonce validation on the 'create_popup_delete_process' function, which handles popup deletion. An attacker can exploit this by crafting a malicious request that, if executed by an authenticated site administrator (e.g., by clicking a link), results in unauthorized deletion of popups. The vulnerability does not require privileges or direct user interaction beyond tricking an admin to perform the action.

The impact is limited to unauthorized deletion of popups within the affected plugin, which may disrupt site functionality or user experience. There is no confidentiality or availability impact reported. The vulnerability requires user interaction by an administrator and does not allow privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.