The Quran Translations plugin for WordPress versions up to 1.7 lacks proper nonce validation in the quran_playlist_options() function, which processes POST requests to update plugin options. Specifically, the plugin does not include wp_nonce_field() in the settings form nor verify the nonce via wp_verify_nonce() or check_admin_referer() before processing updates. This absence of CSRF protection enables attackers to craft forged requests that, if executed by an authenticated administrator, can modify plugin settings without authorization.

An attacker can cause an authenticated administrator to unknowingly modify plugin settings through a CSRF attack. This can alter display options such as enabling or disabling PDF, RSS, podcast, media player links, playlist title, and playlist code. The vulnerability does not impact confidentiality or availability but results in low integrity impact by allowing unauthorized changes to plugin configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches that add nonce validation and CSRF protections.