The CTL Arcade Lite WordPress plugin suffers from a CSRF vulnerability (CWE-352) in all versions up to 1.0. The issue arises from missing or incorrect nonce validation on the 'ctl_arcade_lite_page_manage_games' administrative page. This flaw enables attackers to craft malicious requests that, if executed by an authenticated site administrator, can activate or deactivate plugins without proper authorization. The vulnerability does not require privileges or direct user interaction beyond the administrator clicking a malicious link. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring user interaction, causing limited integrity impact without confidentiality or availability loss. No known exploits in the wild or vendor patches are documented in the provided information.

An attacker can cause unauthorized activation or deactivation of WordPress plugins by exploiting the CSRF vulnerability, potentially disrupting site functionality or security posture. The impact is limited to integrity as no confidentiality or availability impacts are reported. The attack requires tricking an administrator into performing an action, so it depends on social engineering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider implementing additional CSRF protections or restricting administrative access. Monitoring for plugin status changes may help detect exploitation attempts.