The ValvePress WordPress Automatic Plugin suffers from a CSRF vulnerability caused by missing or incorrect nonce validation on one of its functions. This flaw allows unauthenticated attackers to craft forged requests that, when executed by a site administrator (e.g., clicking a malicious link), can update plugin campaigns and inject malicious web scripts. The vulnerability is classified under CWE-80, indicating improper neutralization of script-related HTML tags, resulting in basic XSS. The CVSS 3.1 base score is 4.7 (medium severity) with network attack vector, high attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to unauthorized modification of plugin campaigns and injection of malicious scripts, potentially compromising site confidentiality and integrity. However, exploitation requires tricking an authenticated site administrator to perform an action, and the attack complexity is high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests related to the plugin, especially avoiding clicking untrusted links while logged in as an administrator. Monitoring for plugin updates from ValvePress is recommended to apply any forthcoming patches promptly.