The vulnerability is a Cross‑Site Request Forgery in the NS IE Compatibility Fixer WordPress plugin that allows an unauthenticated attacker to coerce an administrator into sending a forged request that updates the plugin’s settings. Because the plugin’s update endpoint lacks nonce verification, the attacker can change any configurable option without being logged in. The resulting impact is an unauthorized modification of plugin configuration, which could lead to misconfiguration or potentially disable the plugin, thereby affecting site functionality.

All WordPress installations running the NS IE Compatibility Fixer plugin version 2.1.5 or older are affected. The vulnerability originates in the plugin’s admin settings files (ns_admin_option_dashboard.php and ns_settings_custom.php), and affects every installation that deploys that plugin on a WordPress site. Any server hosting a site with this plugin, regardless of the WordPress version, is at risk.

The CVSS score of 4.3 indicates a moderate severity, but the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability does not require elevated privileges or network access beyond the web interface; it relies on an attacker tricking an administrator into clicking a malicious link. The vulnerability is not listed in the CISA KEV catalog, but administrators should still adopt the official patch because the risk of CSRF to modify plugin settings can impair site administration.