The Foxtool All-in-One WordPress plugin suffers from a CSRF vulnerability due to improper nonce validation in the foxtool_login_google() function. This flaw allows attackers to forge requests that, if executed by an authenticated site administrator, can establish an OAuth connection without proper authorization. The vulnerability affects all versions up to and including 2.5.2. The CVSS 3.1 score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official vendor advisory is currently available, and no exploits are known in the wild.

An attacker can exploit this CSRF vulnerability to cause an authenticated site administrator to unknowingly establish an OAuth connection, potentially leading to unauthorized actions related to OAuth integration. The impact is limited to integrity with no direct confidentiality or availability effects. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking links from untrusted sources and consider implementing additional CSRF protections or disabling the affected plugin features if feasible.