The Copymatic WordPress plugin suffers from a CSRF vulnerability due to improper nonce validation on a specific admin page. This flaw enables attackers to perform unauthorized updates to the plugin's API key setting by convincing an administrator to execute a crafted request. The vulnerability affects all versions up to 2.1 and does not require prior authentication but does require user interaction (UI:R). The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause an administrator to unknowingly update the copymatic_apikey option, potentially disrupting plugin functionality or enabling further malicious activity through API key manipulation. The impact is limited to low integrity loss and does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or content that could trigger actions in the Copymatic plugin. Monitoring for updates from the vendor is recommended.