The ARK Related Posts WordPress plugin contains a CSRF weakness due to missing or incorrect nonce validation in the ark_rp_options_page function. As a result, an unauthenticated attacker can trick a site administrator into sending a forged request that updates plugin settings. While the vulnerability does not expose code execution, it permits an attacker to alter configuration values that could affect the site’s content display or functionality, compromising the integrity of the site’s appearance and user experience.

Vendors: alexkar—ARK Related Posts. Affected plugin versions are 2.19 and all earlier releases. No other versions are reported to be impacted.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the current time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to entice a legitimate administrator to execute a link or form that submits a POST request to the settings page, exploiting the missing nonce to bypass authentication checks. Consequently, the primary risk is the unauthorized configuration of the plugin by a non‑privileged actor.