The Quran Gateway plugin for WordPress suffers from a CSRF vulnerability due to the absence of nonce validation in the quran_gateway_options function. This flaw enables attackers to perform unauthorized changes to the plugin's display settings by exploiting the trust of an authenticated administrator who is tricked into executing a crafted request. The vulnerability affects all versions up to and including 1.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No patch or official remediation has been documented in the provided information.

An attacker can modify the display settings of the Quran Gateway plugin without authentication by exploiting this CSRF vulnerability. This could lead to unauthorized changes in the plugin's behavior or appearance on the affected WordPress site. There is no indication of confidentiality or availability impact, and no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.