CVE-2026-1380 is a CSRF vulnerability in the lxicon Bitcoin Donate Button WordPress plugin (versions up to 1.0). The issue arises from missing or incorrect nonce validation on the plugin's settings page, enabling attackers to forge requests that modify plugin settings without authentication, contingent on administrator interaction. This vulnerability is classified under CWE-352 and has a CVSS 3.1 score of 4.3 (medium severity). No known exploits are reported, and no patch or remediation details have been provided.

An attacker who successfully exploits this vulnerability can alter the plugin's settings, including donation addresses and display options, without authentication. This could lead to redirecting donations to attacker-controlled addresses or changing how donation information is presented. However, exploitation requires tricking a site administrator into performing an action such as clicking a crafted link. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution by avoiding clicking on untrusted links and consider restricting access to the plugin's settings page to trusted users only.