The Phee’s LinkPreview plugin fails to perform CSRF validation, allowing an attacker to forge requests that a victim’s browser will automatically submit. This flaw can be leveraged when a user is authenticated to the WordPress site and can result in the attacker changing plugin configuration or executing any other actions the user is authorized to perform. The vulnerability is identified as CWE‑352 and carries a CVSS score of 4.3, indicating a medium‑severity impact on confidentiality and integrity.

WordPress sites that use the Phee’s LinkPreview plugin version 1.6.7 or earlier are the only impacts. The vendor listed is filipstepanov, and no other WordPress core components or third‑party plugins are affected.

With an EPSS score of less than 1% and not listed in the CISA KEV catalog, exploitation is unlikely at present, but the attack vector remains a web‑application CSRF that requires an active session of an authenticated user. The medium CVSS score reflects the ability to alter data or configuration, but no immediate denial of service or remote code execution risk is noted. Security teams should treat the vulnerability as low to moderate risk pending an available patch.