Coding Blocks WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Coding Blocks plugin for WordPress, affecting all versions up to and including 1.1.0. The vulnerability arises from a lack of nonce validation in the settings update feature, allowing unauthenticated attackers to manipulate plugin settings, including theme configurations. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in plugin settings, including the theme configuration, potentially disrupting the site's appearance or functionality.