User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery

An unauthenticated attacker crafts a malicious link or form that triggers a forged request to the `useradminsimplifier_options_page` function. Because the function is missing nonce validation [ref_id=1], the request can call `uas_save_admin_options()` without any proof of intent. The attacker must trick a logged-in site administrator into clicking the link or submitting the form (a classic CSRF attack). Once the forged request is processed, the plugin overwrites the `useradminsimplifier_options` database entry, resetting and permanently deleting the stored menu and admin-bar configuration for any user.

The vulnerability resides in the `useradminsimplifier_options_page` function, which lacks nonce validation when processing the `uas_save_admin_options()` action. This allows an unauthenticated attacker to forge a request that overwrites the `useradminsimplifier_options` database entry, resetting and permanently deleting any user's stored menu and admin-bar configuration.

The advisory does not include a published patch, but the plugin's changelog for version 3.0.1 states: "Security hardening: sanitize option keys when saving user settings." This fix addresses the missing input sanitization that could be exploited via the CSRF vector. Without nonce validation, an attacker can trigger the save function; the sanitization of option keys in 3.0.1 reduces the impact by preventing arbitrary key injection, but the advisory notes the root cause is the missing nonce check on the `useradminsimplifier_options_page` function.