The WPBlogSyn plugin contains a Cross‑Site Request Forgery flaw that allows any unauthenticated user to alter the plugin’s remote sync settings. Missing or incorrect nonce validation means a crafted request can be accepted without the proper security token. If exploited, an attacker can modify where the plugin pushes or pulls content, potentially enabling unauthorized data transfer or disrupting site operations.

All installations of the WPBlogSyn WordPress plugin from vendor Obridge Academy with version 1.0 or earlier are affected.

The CVSS score of 4.3 categorizes this vulnerability as moderate severity. The EPSS indicates a very low exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves a phishing or social engineering trick that causes an administrator to click a malicious link, thereby submitting a forged request that updates the remote sync configuration. Because the exploit requires the site administrator to perform an action, the risk is mitigated by security awareness and user training.