The Zuppler Online Ordering plugin for WordPress versions up to 2.1.0 contains a CSRF vulnerability due to improper nonce validation on its settings page. This allows attackers to craft malicious requests that, if executed by an authenticated administrator, can alter plugin settings or inject malicious code. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can impact confidentiality and integrity with no impact on availability. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, scoring 6.1 (medium). No patch or official remediation guidance has been provided by the vendor at this time.

Successful exploitation can lead to unauthorized modification of plugin settings and injection of malicious web scripts, potentially compromising site confidentiality and integrity. The attack requires tricking an administrator into performing an action, but no authentication is needed for the attacker. There is no reported impact on availability and no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid clicking on suspicious links and consider restricting access to the 'zuppler-online-ordering-options' page to trusted users only. Monitoring for unusual changes in plugin settings may help detect exploitation attempts.