CVE-2026-6710 is a CSRF vulnerability in the Skysa Text Ticker App WordPress plugin affecting all versions up to 1.4. The issue is due to missing or incorrect nonce validation in the SkysaApps_Admin_AppPage function, allowing attackers to craft malicious requests that, if executed by an authenticated site administrator, can alter plugin settings without proper authorization. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and requires user interaction. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an attacker to modify the plugin's settings, including the scrolling message text and URL, without proper authorization. This could lead to unauthorized content changes on the affected WordPress site. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should exercise caution when interacting with untrusted links or content that could trigger plugin setting changes. Monitoring for updates from the vendor or plugin author is recommended.