CVE-2026-1377 describes a CSRF vulnerability in the hu_chao imwptip WordPress plugin affecting all versions up to 1.1. The root cause is the absence of nonce validation on the settings update endpoint, which enables attackers to craft malicious requests that, if executed by an authenticated administrator, can alter plugin settings without proper authorization. The vulnerability requires user interaction (UI:R) but no privileges or authentication (PR:N) to exploit. The CVSS score of 4.3 reflects limited impact, specifically low integrity impact and no confidentiality or availability impact.

An attacker can cause an authenticated site administrator to unknowingly change the plugin's settings by tricking them into clicking a malicious link or visiting a crafted webpage. This could lead to unauthorized configuration changes within the plugin, potentially affecting site behavior or security posture. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

No official patch or fix is currently available for this vulnerability. Administrators should exercise caution and avoid interacting with untrusted links or sites while logged into WordPress with administrative privileges. Monitor the vendor's advisory channels for updates regarding a patch or official remediation. Since this is a CSRF vulnerability, implementing or enforcing nonce validation on the plugin's settings update functionality is the recommended fix once available.