The TextP2P Texting Widget plugin for WordPress suffers from a CSRF vulnerability due to the absence of nonce validation in the imTextP2POptionPage() function. Specifically, the form responsible for settings updates lacks a wp_nonce_field(), and the POST request handler does not verify the nonce using check_admin_referer() or wp_verify_nonce(). This allows unauthenticated attackers to submit forged requests that modify all plugin settings if an administrator is tricked into performing an action such as clicking a crafted link. The vulnerability affects all versions up to and including 1.7.

An attacker can cause a site administrator to unknowingly submit a request that changes plugin settings, including sensitive configurations like API credentials and reCAPTCHA settings. This could lead to unauthorized control over the plugin's behavior and potentially weaken site security or functionality. There is no direct confidentiality or availability impact indicated, but integrity of plugin settings is compromised.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates. Until a patch is available, administrators should avoid clicking untrusted links while logged into WordPress admin and consider restricting access to the plugin settings page. Implementing manual nonce validation or other CSRF protections in the plugin code could mitigate the risk.