The WP Admin Microblog plugin for WordPress is vulnerable to Cross‑Site Request Forgery (CWE‑352) because it fails to validate nonces on the 'wp-admin-microblog' page. This flaw allows any unauthenticated attacker who can trick a site administrator into clicking a crafted link to cause the administrator to post a message on the microblog. The attacker does not gain direct code execution or data disclosure, but can create arbitrary posts under an admin’s identity and potentially spread misinformation or spam.

The vulnerability affects all versions of the WP Admin Microblog plugin up to and including 3.1.1. Site administrators running WordPress with any of these plugin versions are at risk. No specific WordPress core versions are listed, so the issue is confined to the plugin itself.

The moderate CVSS score of 4.3 reflects moderate impact and requires attacker to target an authenticated administrator through a crafted request. Because the EPSS score is less than 1%, the likelihood of widespread exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to send a forged request to the microblog endpoint, which could be triggered by a malicious link or a compromised website that the admin visits.