The averta Depicter plugin for WordPress versions ≤ 4.0.4 contains a CSRF vulnerability (CWE-352) due to improper or missing nonce validation on the depicter-document-rules-store function. This allows attackers to forge requests that, when executed by an authenticated site administrator, can modify document rules without proper authorization. The vulnerability is network exploitable without privileges but requires user interaction (UI:R). It has a CVSS 3.1 base score of 4.3, indicating medium severity with limited impact on integrity and no impact on confidentiality or availability. No patch or official remediation guidance is currently available from the vendor.

An attacker can cause an authenticated administrator to unknowingly modify document rules via a forged request, potentially altering site behavior or content managed by the Depicter plugin. There is no direct impact on confidentiality or availability. The integrity impact is limited to the modification of document rules. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should exercise caution when clicking links or interacting with untrusted content while logged into WordPress sites using the affected plugin version. Implementing additional CSRF protections or disabling the plugin temporarily may reduce risk.