The BLOGCHAT Chat System plugin for WordPress suffers from a CSRF vulnerability due to missing or incorrect nonce validation on a function. This flaw permits unauthenticated attackers to craft forged requests that, if executed by a site administrator (e.g., by clicking a malicious link), can update plugin settings and inject malicious web scripts. The vulnerability affects all versions up to and including 1.3.6.3. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No patch or official fix has been published yet.

Successful exploitation allows an attacker to perform unauthorized changes to the plugin settings and inject malicious scripts by leveraging a site administrator's interaction with a crafted request. This can lead to partial compromise of confidentiality and integrity of the affected WordPress site. There is no known impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests that could trigger plugin actions, especially avoiding clicking untrusted links while logged in as an administrator. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.