A Cross‑Site Request Forgery flaw in the ClickWhale WordPress plugin lets an attacker force a logged‑in user to modify plugin configuration. The vulnerability does not provide arbitrary code execution, but it enables an attacker to alter settings that could compromise site functionality or create a backdoor. It is classified as CWE‑352, a weakness that allows unauthorized state changes.

The flaw affects the ClickWhale plugin for WordPress, versions up to and including 2.4.3, distributed by ClickWhale. Any WordPress site running one of these versions is vulnerable.

The CVSS score is 5.4, indicating moderate severity, while the EPSS score of < 1% suggests a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Exploitation generally requires a user to be authenticated and the attacker to supply a crafted request—typically through a malicious link or form—to change plugin settings. The overall risk lies in potential configuration corruption, not in direct system compromise.