The MailUp Auto Subscription plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation in the mas_options function in all versions up to 1.1.0. This flaw enables attackers to forge requests that, when executed by an authenticated administrator, can modify plugin settings and inject malicious web scripts. The vulnerability is remotely exploitable without privileges but requires user interaction (UI:R). It impacts confidentiality and integrity with no impact on availability, reflected by a CVSS 3.1 score of 6.1.

An attacker can exploit this vulnerability to update plugin settings and inject malicious scripts by tricking an administrator into clicking a malicious link. This can lead to partial compromise of site confidentiality and integrity. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links and consider limiting administrative access or using additional CSRF protections if possible.