An unprotected action in the AnyRoad anyguide plugin allows an attacker to trick a logged‑in WordPress user into unintentionally performing a privileged request. The weakness is identified as CWE‑352, which enables the attacker to forge a legitimate request on behalf of the user. Because the vulnerability does not provide direct code execution, its impact is limited to unauthorized actions that the user’s account permits.

All WordPress sites running the AnyRoad anyguide plugin version 1.3.2 or earlier are affected. No specific WordPress core version constraints are listed, so the risk applies to any installation that has not updated the plugin.

The vulnerability carries a CVSS score of 4.3, placing it in the low‑severity range. The EPSS score of less than 1 % indicates a very small chance of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user to visit a crafted link or form that the plugin accepts, after which the attacker can trigger actions that the user is authorized to perform.