The doubledome Resource Library for Logged In Users WordPress plugin suffers from a CSRF vulnerability (CWE-352) due to the absence of nonce validation on several administrative functions. This flaw enables an attacker to craft malicious requests that, when executed by an authenticated administrator, can perform unauthorized modifications including creation, editing, and deletion of resources and categories. The vulnerability affects all plugin versions up to 1.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

An attacker can exploit this vulnerability by tricking an authenticated site administrator into clicking a crafted link or visiting a malicious webpage, resulting in unauthorized changes to the resource library content such as creating, editing, or deleting resources and categories. There is no direct impact on confidentiality or availability reported, but integrity of the resource data can be compromised. No known exploits in the wild have been reported to date.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, administrators should exercise caution when interacting with untrusted links or websites and consider limiting administrative access or employing additional CSRF protections via security plugins or web application firewalls that can detect and block CSRF attempts.