CVE-2026-3331 is a Cross-Site Request Forgery vulnerability in the chuckmo Lobot Slider Administrator WordPress plugin, affecting versions up to 0.6.0. The issue is due to missing or incorrect nonce validation in the 'fourty_slider_options_page' function, which handles slider configuration. This allows an attacker to craft a forged request that, if executed by an authenticated administrator (e.g., via clicking a malicious link), can modify plugin settings without proper authorization. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact to integrity only.

An attacker can cause unauthorized modification of the slider-page configuration in the Lobot Slider Administrator plugin by exploiting the CSRF vulnerability. This does not impact confidentiality or availability but can affect the integrity of the plugin's settings. The attack requires tricking an authenticated administrator into performing an action, such as clicking a malicious link.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's communications for updates. As a temporary mitigation, administrators should avoid clicking on untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the plugin until a fix is available may reduce risk.