The CDN Linker lite plugin for WordPress versions up to 1.3.1 contains a CSRF vulnerability due to improper nonce validation in the ossdl_off_options() function. This flaw enables attackers to forge requests that update plugin settings, including the CDN URL configuration, by tricking site administrators into executing unintended actions. The vulnerability does not require privileges or direct user interaction beyond the administrator clicking a crafted link. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and no direct confidentiality or availability impact. No patch or official remediation level has been published by the vendor as of the data provided.

An attacker can cause an authenticated site administrator to unknowingly change the CDN URL used by the plugin, potentially redirecting static asset requests to attacker-controlled resources. This could lead to indirect risks such as content injection or manipulation depending on the attacker's control over the CDN URL. There is no direct impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests that could trigger plugin settings changes. Implementing additional CSRF protections or disabling the plugin if not needed may reduce risk. Monitor official vendor channels for updates.