The Google PageRank Display plugin for WordPress (by byybora) is vulnerable to CSRF due to missing nonce validation in the gpdisplay_option() function, which handles the plugin's settings page. The settings form does not include a wp_nonce_field(), and the form handler does not verify a nonce before processing POST requests. This allows unauthenticated attackers to trick logged-in administrators into changing plugin settings such as display style via crafted requests. The vulnerability affects versions up to and including 1.4. No patch or official remediation has been published as of the data provided.

An attacker can exploit this vulnerability to cause a logged-in administrator to unknowingly change the plugin's settings, potentially altering how the PageRank badge is displayed. This does not directly impact confidentiality or availability but can lead to unauthorized configuration changes, which may affect site appearance or behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit plugin usage to trusted environments and avoid visiting untrusted sites while logged into WordPress admin. Monitoring for updates from the vendor is recommended.