The LockerPress WordPress Security Plugin contains a CSRF vulnerability (CWE-352) due to improper or missing nonce validation in a function, affecting all versions up to 1.0. This flaw enables attackers to craft forged requests that, if executed by an authenticated site administrator, can lead to unauthorized changes in plugin settings and injection of malicious web scripts. The vulnerability has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. No patch or official remediation guidance has been published as of the provided data.

Successful exploitation allows an attacker to perform unauthorized actions by tricking an authenticated administrator into submitting a malicious request. This can lead to unauthorized modification of plugin settings and injection of malicious scripts, potentially compromising site integrity and security. The impact is limited to confidentiality and integrity with no direct availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with plugin usage and avoid clicking on suspicious links or performing actions from untrusted sources that could trigger forged requests. Monitoring for updates from the plugin vendor is recommended.