The GoStats for WordPress plugin suffers from a CSRF vulnerability due to improper nonce validation in the gostats_manage() function. This flaw enables attackers to forge requests that update plugin settings (specifically gostats_siteid and gostats_server options) if an administrator is tricked into executing the request. The vulnerability affects all versions up to and including 1.4. There is no vendor-provided patch or official remediation level at this time, and no known exploits are reported in the wild.

An attacker can cause an authenticated administrator to unknowingly change plugin settings via a forged request, potentially altering the behavior of the GoStats plugin. The impact is limited to integrity (modification of plugin settings) without confidentiality or availability effects. The CVSS score of 4.3 reflects a medium severity level with low complexity and no privileges required but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links while logged into WordPress with administrative privileges. Implementing additional CSRF protections or disabling the plugin if not needed may reduce risk.