The Reuters Direct plugin for WordPress suffers from a CSRF vulnerability due to improper or absent nonce validation on its settings page. This flaw allows an attacker to craft a malicious request that, if executed by an authenticated site administrator, can reset the plugin's settings without their consent. The vulnerability affects all versions up to 3.0.0. The CVSS 3.1 vector indicates the attack requires no privileges but does require user interaction (UI:R), and impacts integrity with no confidentiality or availability impact.

An attacker can cause an authenticated administrator to unknowingly reset the Reuters Direct plugin settings by exploiting the CSRF vulnerability. This could lead to configuration changes that may disrupt plugin functionality or weaken security controls. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when clicking links or performing actions from untrusted sources. Monitoring vendor communications for updates or patches is recommended.