Bitcoin Donate Button WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Bitcoin Donate Button plugin for WordPress, affecting all versions through 1.0. The issue arises from inadequate nonce validation on the settings page, allowing unauthenticated attackers to alter the plugin's settings, such as donation addresses and display options. This can be achieved by tricking a site administrator into clicking a link that sends a forged request.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the plugin's settings by an attacker, potentially leading to misdirected donations or altered display configurations on the site.