The 'Admin in English with Switch' WordPress plugin versions up to 1.1 suffer from a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation on the enable_eng function. This flaw enables unauthenticated attackers to modify administrator language settings by tricking an admin into performing an action such as clicking a malicious link. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and no privileges required, but user interaction is necessary. No known exploits in the wild have been reported, and no patch or remediation details are provided in the available data.

An attacker can cause an administrator to unknowingly change language settings via a forged request, impacting the integrity of the administrator's configuration. There is no impact on confidentiality or availability. The vulnerability requires user interaction and no privileges, making it a moderate risk but limited in scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links and consider implementing additional CSRF protections or disabling the plugin if feasible.