The Homerunner plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to improper or missing nonce validation in its main_settings() function. This flaw allows attackers to craft forged requests that, when executed by an authenticated site administrator, can modify plugin settings without proper authorization. The vulnerability affects all versions up to 1.0.30. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and limited impact on integrity only. There is no vendor advisory or patch information available at this time.

An attacker can cause an authenticated site administrator to unknowingly submit a malicious request that changes plugin settings. This could lead to unauthorized configuration changes, potentially weakening site security or functionality. The vulnerability does not impact confidentiality or availability directly. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests received while logged into WordPress, especially from untrusted sources. Implementing additional CSRF protections or disabling the plugin temporarily may reduce risk.