The Colibri Page Builder plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation in the cp_shortcode_refresh() function. This allows attackers to execute arbitrary shortcodes by leveraging the trust of authenticated administrators who may be tricked into clicking a crafted link. The vulnerability affects all versions up to and including 1.0.253. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No patch or official remediation has been disclosed yet.

An attacker can cause an authenticated administrator to unknowingly execute arbitrary shortcodes via a forged request, potentially leading to limited impact such as unauthorized shortcode execution. There is no direct confidentiality or availability impact reported. The vulnerability requires user interaction and targets administrative users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links and consider restricting administrative access or implementing additional CSRF protections at the site level.