The Linux Promotional Plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation on the 'inux-promotional-plugin.php' page. This flaw allows attackers to forge requests that can update plugin settings or inject malicious web scripts by exploiting the trust of an authenticated administrator who interacts with a malicious link. The vulnerability affects all versions up to 1.4 and has a CVSS 3.1 base score of 6.1, reflecting a medium severity impact with network attack vector, low attack complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity. No patch or official fix has been documented, and no known exploits have been reported.

Successful exploitation could allow an attacker to modify plugin settings or inject malicious scripts by tricking an administrator into executing a forged request. This could lead to partial disclosure of information and integrity compromise within the affected WordPress site. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links and consider restricting administrative access or implementing additional CSRF protections at the site level. Monitor official vendor channels for updates regarding patches or mitigations.