The CM Tooltip Glossary plugin for WordPress suffers from a CSRF vulnerability due to improper or absent nonce validation during the saving of plugin settings. This enables attackers to craft malicious requests that, when executed by an authenticated administrator (e.g., clicking a link), can alter or reset the plugin's configuration without authorization. The vulnerability affects all versions up to and including 4.2.11. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, no privileges required, user interaction needed, and limited impact on integrity only.

An attacker can cause an authenticated site administrator to unknowingly change or reset the CM Tooltip Glossary plugin settings by tricking them into submitting a forged request. This could lead to unauthorized configuration changes, potentially affecting site behavior or security posture related to the plugin. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid interacting with untrusted links or requests that could trigger plugin setting changes. Monitoring for updates from creativemindssolutions regarding a security patch is recommended.