CTL Arcade Lite WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the CTL Arcade Lite plugin for WordPress, affecting all versions up to and including 1.0. The vulnerability arises from inadequate nonce validation on the 'ctl_arcade_lite_page_manage_games' page. This flaw allows unauthenticated attackers to deactivate and activate arbitrary plugins by sending a forged request, provided they can persuade a site administrator to click a link or perform a similar action.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling unauthorized actions to be performed on behalf of a user, such as deactivating or activating plugins.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.