The Custom Login And Signup Widget plugin for WordPress suffers from a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation in the /frndzk_adminclsw.php file. This flaw enables attackers to craft malicious requests that, when executed by an authenticated site administrator (e.g., by clicking a link), can change email and username settings without proper authorization. The vulnerability affects all plugin versions up to 1.0. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or vendor advisory is currently provided.

The vulnerability allows unauthorized modification of email and username settings by exploiting CSRF, which can lead to limited integrity compromise of the affected WordPress site. There is no impact on confidentiality or availability. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on suspicious links and consider implementing additional CSRF protections such as web application firewalls or custom nonce validation as a temporary measure.