The odude Crypto Tool WordPress plugin versions up to 2.15 suffer from a CSRF vulnerability (CWE-352) due to the absence of nonce validation in the 'crypto_connect_ajax_process::check' function. This security weakness enables attackers to forge requests that can cause an administrator or other privileged user to unknowingly perform actions that result in the attacker gaining authenticated access as that user. The vulnerability is remotely exploitable without prior authentication but requires user interaction (UI:R). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to log in as any existing user on the affected WordPress site, including administrators. This can lead to full compromise of the site’s confidentiality, integrity, and availability. The attacker can perform any actions permitted to the impersonated user, potentially leading to site takeover or data theft.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should exercise caution to avoid clicking on untrusted links and consider disabling or removing the affected plugin version. Implementing additional CSRF protections or security plugins that enforce nonce validation may help mitigate risk temporarily.