The SocialChamp WordPress plugin 'Auto Post to Social Media from Social Champ' is vulnerable to CSRF due to missing nonce validation in the wpsc_settings_tab_menu function. This flaw allows attackers to perform unauthorized changes to plugin settings by exploiting the trust of an authenticated administrator who is tricked into submitting a forged request. The vulnerability affects all plugin versions up to and including 1.3.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No known exploits are reported in the wild, and no patch or remediation guidance has been provided by the vendor as of the published date.

An attacker can modify plugin settings without authentication by exploiting the CSRF vulnerability if they can convince an administrator to perform an action such as clicking a crafted link. This could lead to unauthorized configuration changes impacting the plugin's behavior. There is no direct confidentiality, availability, or integrity impact beyond the plugin settings modification as per the CVSS vector and description.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links while logged into WordPress and consider restricting administrative access or using additional CSRF protection plugins as a temporary mitigation.