The AMP for WP – Accelerated Mobile Pages plugin for WordPress contains a CSRF vulnerability due to improper nonce validation in the 'proxy' function. This flaw affects all versions up to and including 1.0.99.1. An attacker can exploit this by crafting a malicious request that, when performed by a logged-in site administrator (e.g., by clicking a link), causes the administrator's cookies to be sent to the attacker. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. No patch or official fix information is currently provided in the data.

Exploitation of this vulnerability can lead to unauthorized disclosure of administrator session cookies, potentially allowing attackers to hijack administrative sessions or perform unauthorized actions with administrative privileges. The impact includes high confidentiality, integrity, and availability risks as indicated by the CVSS score. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or content that could trigger the vulnerable 'proxy' function. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.