IMAQ Core WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the IMAQ Core plugin for WordPress, affecting all versions through 1.2.1. The issue arises from a lack of nonce validation in the URL structure settings update feature, allowing unauthenticated attackers to manipulate these settings by sending forged requests, provided they can deceive a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the URL structure settings of the IMAQ Core plugin, potentially disrupting the site's permalink configuration for custom post types.