The IndieAuth WordPress plugin is vulnerable to Cross‑Site Request Forgery due to missing nonce verification in the login_form_indieauth() function and the authorization endpoint. Unauthenticated attackers can force a logged‑in user to approve OAuth requests for attacker‑controlled applications. Once the victim authorises, the attacker can exchange the obtained authorization code for an access token and gain full control of the victim's account with scopes that allow creating, updating, and deleting content. The vulnerability is a classic example of authentication bypass leading to account takeover.

Vendors affected are indieweb:IndieAuth. All releases of the IndieAuth plugin for WordPress up to and including version 4.5.4 are impacted. WordPress sites running any of these plugin versions are at risk, regardless of the site’s WordPress core version.

The CVSS score of 8.8 indicates a high severity. The EPSS score of less than 1% suggests a low probability of exploitation in the current landscape, but the fact that it is not listed in CISA’s KEV catalog does not diminish the need for a quick response. Exploitation requires only social engineering to lure the target user to a crafted link or page while they are logged in; the attacker does not need site credentials. Once the forged request is processed, the attacker receives an access token and effectively takes over the user’s account. Because the scope of the token can include full CRUD rights, the impact can be destructive to site content.