Search Simple Fields WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Search Simple Fields plugin for WordPress, affecting versions through 0.2. The issue arises from inadequate nonce validation in the search_simple_fields_options() function within functions_admin.php. This vulnerability allows unauthenticated attackers to alter the plugin's settings—such as the post types to search, custom fields, media fields, and the custom media function name—by sending a forged request, provided they can persuade a site administrator to click a link or perform a similar action.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the plugin's settings, potentially allowing attackers to manipulate how the plugin interacts with posts and media.