The vulnerability in the smub Reviews Feed WordPress plugin is due to improper nonce validation in the 'update_api_key' function, enabling Cross-Site Request Forgery attacks. An unauthenticated attacker can exploit this by convincing an administrator to perform an action such as clicking a malicious link, which results in unauthorized modification of the API key. This affects all versions up to and including 1.1.2.

Successful exploitation allows an attacker to update the API key used by the plugin without authentication, potentially disrupting plugin functionality or enabling further attacks that rely on API key manipulation. There is no direct impact on confidentiality or availability reported, but integrity is affected due to unauthorized changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid interacting with untrusted links or requests that could trigger the update_api_key function. Monitoring for plugin updates from the vendor is recommended to apply any official fixes once released.