The Laiser Tag plugin for WordPress suffers from a CSRF vulnerability due to improper nonce validation in the addOptionsPageFields function. This flaw allows an attacker to craft a forged request that, if executed by an authenticated site administrator, can modify critical plugin settings without authorization. The vulnerability affects all versions up to and including 1.2.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed. No patch or official remediation level is currently available.

An attacker can cause an authenticated administrator to unknowingly change plugin settings, potentially disrupting plugin functionality or compromising configuration integrity. However, the vulnerability does not directly impact confidentiality or availability, only integrity of plugin settings. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links or content that could trigger plugin setting changes. Monitoring for updates from the vendor or plugin maintainers is recommended.