The vulnerability is a classic Cross‑Site Request Forgery (CSRF) flaw in the WP Spell Check plugin for WordPress. An attacker can trick a legitimate site visitor, who is already authenticated, into executing unintended requests that the plugin processes. This can lead to unauthorized changes in the plugin’s configuration or other privileged actions, potentially affecting the integrity and confidentiality of the site’s content. The weakness is classified as CWE‑352.

The affected product is the WP Spell Check plugin for WordPress, version 9.21 and earlier. The vulnerability applies to all installations of the plugin without a later update, regardless of the underlying WordPress version.

The CVSS score of 5.4 reflects a moderate severity. The EPSS score of less than 1% indicates a very low chance of exploitation at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently tied to known widespread attacks. The likely attack vector requires the target user to be authenticated to the site, and the attacker typically delivers a malicious link or image that triggers the unwanted request. Because the plugin relied on no anti‑CSRF token, the flaw can be leveraged without additional conditions, but an authenticated user is still needed.