The WP Landing Page plugin for WordPress contains a CSRF flaw that allows an attacker to update arbitrary post meta by sending a forged request when an administrator clicks a link. The flaw arises because the wplp_api_update_text endpoint does not validate a nonce, so any unauthenticated request can be accepted. An attacker can then modify any post meta key/value pair, potentially changing content, settings, or other data that the site administrator expects to be protected.

Any WordPress site running the WP Landing Page plugin version 0.9.3 or older is affected. The vulnerability is limited to the plugin and does not impact core WordPress or other plugins. Sites that rely on the plugin to manage landing pages or meta data for posts are therefore at risk.

The CVSS score of 4.3 indicates moderate severity. EPSS below 1% shows low likelihood of observed exploitation at this time. The vulnerability is not listed in CISA KEV. Attackers would need to lure an administrator into clicking a malicious link or submitting a form that triggers the unchecked endpoint. Once the endpoint is hit, the attacker can alter any post meta without authentication, making exploitation straightforward given a successful social engineering vector.