ViaAds WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the ViaAds WordPress plugin, affecting all versions up to and including 2.1.1. The issue arises from a lack of nonce validation in the 'ViaAds_pluginHandler' function, allowing unauthenticated attackers to alter the plugin's API key and cookie consent settings. Exploitation requires tricking an administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the API key and cookie consent settings within the ViaAds WordPress plugin.