The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin suffers from a CSRF vulnerability (CWE-352) in all versions up to 1.19. The root cause is missing or incorrect nonce validation on the 'sertifier_settings' page, which enables attackers to forge requests that update the plugin's API key if a site administrator is tricked into executing the action. This vulnerability requires user interaction (UI:R) and has no direct confidentiality or availability impact but can lead to integrity loss by modifying the API key. The vulnerability is network exploitable without privileges (AV:N/PR:N). No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor.

An attacker can exploit this vulnerability to change the plugin's API key by tricking an administrator into clicking a crafted link or performing a specific action. This could potentially disrupt the plugin's functionality or allow further misuse of the API key. There is no direct impact on confidentiality or availability reported. The overall impact is limited to integrity modification of the plugin's configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger changes in the plugin settings. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.