The Google PageRank Display plugin for WordPress suffers from a CSRF vulnerability due to missing nonce validation in the gpdisplay_option() function, which manages the plugin's settings page. Specifically, the settings form does not include a wp_nonce_field(), and the form handler does not verify any nonce via check_admin_referer() or wp_verify_nonce() before processing POST requests. This flaw allows unauthenticated attackers to coerce logged-in administrators into submitting crafted requests that alter plugin settings stored via update_option(), such as the display style of the PageRank badge. The vulnerability affects all versions up to and including 1.4. There is no vendor-provided patch or official fix at this time.

An attacker can exploit this vulnerability to change the plugin's settings by tricking an authenticated administrator into submitting a malicious request. This could lead to unauthorized changes in how the PageRank badge is displayed on the site. The vulnerability does not allow direct code execution, data disclosure, or denial of service, but it compromises the integrity of the plugin's configuration. The CVSS score of 4.3 reflects a medium impact primarily on integrity with no impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious about visiting untrusted sites while logged into WordPress with administrative privileges. Implementing manual nonce validation in the plugin code or disabling the plugin temporarily may reduce risk. No official patch or temporary fix is currently available.