The ashikcse WordPress plugin 'CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts' suffers from a Cross-Site Request Forgery vulnerability (CWE-352) in all versions up to and including 4.2. This is due to missing or incorrect nonce validation in the cits_settings_tab() function, which handles plugin settings. An attacker can exploit this by tricking an authenticated site administrator into submitting a crafted request, resulting in unauthorized modification of plugin settings. The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction and resulting in low impact on integrity without affecting confidentiality or availability.

Successful exploitation allows an attacker to update the plugin's settings without authentication by leveraging a CSRF attack that requires tricking an administrator into performing an action. This could lead to unauthorized changes in plugin configuration, potentially affecting site behavior or security posture. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution by avoiding clicking on suspicious links and consider restricting administrative access or implementing additional CSRF protections at the site level. Monitor official vendor channels for updates and patches addressing this vulnerability.