CVE-2026-6710 is a CSRF vulnerability in the Skysa Text Ticker App WordPress plugin due to improper nonce validation in the administrative function SkysaApps_Admin_AppPage. This allows unauthenticated attackers to craft malicious requests that, if executed by a site administrator, can alter plugin settings including the scrolling message and URL. The vulnerability affects all versions up to 1.4. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cause a site administrator to unknowingly modify the plugin's settings, potentially changing displayed messages or URLs. This could lead to misinformation or redirect users to unintended locations. There is no direct impact on confidentiality or availability, and the integrity impact is limited to the plugin's settings. No known exploits are reported in the wild.

Patch status is not yet confirmed — no official fix or vendor advisory is available at this time. Administrators should monitor for updates from the plugin vendor and apply any official patches once released. Until then, limiting administrative access and avoiding clicking on suspicious links can reduce risk.