WordPress Publish Approval Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress Publish Approval plugin, affecting all versions through 1.1. The issue arises from inadequate nonce validation in the 'publish_save_option' function, allowing unauthenticated attackers to alter plugin settings. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the plugin's settings, potentially allowing attackers to manipulate approval workflows or related functionalities.