The vulnerability stems from an improper nonce validation in the class-wpgsi-show.php file of the Spreadsheet Integration plugin for WordPress. This defect allows attackers to forge requests on behalf of an authenticated administrator, causing posts to be published without authorization. The impact includes the creation of public, private or otherwise hidden content controlled by the attacker. The weakness is classified as CWE‑352, a Cross‑Site Request Forgery flaw.

WordPress sites that have installed the Spreadsheet Integration plugin from the vendor javmah. Versions up to and including 3.8.2 are affected. Administrators operating these sites are thus at risk.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Exploitability relies on social engineering: a malicious link or script must trick an site administrator into clicking in order to trigger the forged request. No additional privileges or remote code execution are required beyond the administrator’s authenticated session.