A Cross-Site Request Forgery vulnerability in the Search Analytics for WP plugin allows attackers to perform unauthorized actions on behalf of authenticated administrators.

The plugin lacks proper validation for state-changing requests, enabling Cross-Site Request Forgery (CWE-352). This allows an unauthenticated attacker to trick an administrator into executing unintended, malicious actions within the plugin interface.

Successful exploitation can lead to unauthorized changes to search tracking configurations or other administrative data managed by the plugin. With a CVSS score of 8.1, the high severity reflects the potential for significant integrity compromise within the WordPress environment, which could be leveraged to further impact site functionality.

Immediate Action: Update the Search Analytics for WP plugin to the latest version available beyond 1.4.16 to incorporate the necessary security fixes.

Proactive Monitoring: Review administrative access logs for unusual patterns or unexpected configuration changes originating from the plugin interface.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block suspicious cross-site request patterns.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score of 8.1, this vulnerability poses a substantial risk to site integrity. Administrators should prioritize updating this plugin immediately to prevent unauthorized administrative actions and ensure the continued security of their WordPress installation.