A Cross‑Site Request Forgery flaw allows an attacker to change settings in the Indeed API plugin without the victim’s knowledge, potentially causing unwanted configuration changes or enabling further compromise. The weakness is a classic CSRF bug (CWE-352) that could alter plugin behavior in a way that benefits the attacker, affecting the integrity of the WordPress site.

All WordPress installations that include the bnielsen Indeed API plugin up to version 0.5 are vulnerable. The plugin version series is listed as "from n/a through <= 0.5," meaning any released build before or equal to 0.5 can be impacted.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at present. Because this is a CSRF vulnerability, the attacker’s path typically involves sending a crafted link or form to a logged‑in user to trigger a state change. The vulnerability is not currently listed in CISA’s KEV catalog, reducing the urgency compared to actively exploited issues.