GoStats for WordPress Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the GoStats for WordPress plugin, affecting all versions up to and including 1.4. The issue arises from inadequate nonce validation in the 'gostats_manage()' function, allowing unauthenticated attackers to manipulate the plugin's settings by sending forged requests. Exploitation requires tricking a site administrator into clicking a link that activates the request.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the plugin's settings, specifically the 'gostats_siteid' and 'gostats_server' options.

Remediation

There is no known patch available for this vulnerability. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.