A Cross‑Site Request Forgery vulnerability exists in the Namaste! LMS WordPress plugin that allows a malicious actor to submit forged requests on behalf of an authenticated user. The flaw resides in the front‑end handling of user‑initiated actions that lack proper CSRF token validation, meaning an attacker could, for example, enroll a user in a course or change course settings without the user’s consent. While the severity is moderate (CVSS 4.3), the impact reaches the integrity of the LMS data and could erode trust among users.

The flaw affects the Namaste! LMS plugin by Bob for WordPress versions up through 2.6.5. Any deployment of the plugin below 2.6.6 is vulnerable; newer releases are not impacted.

The EPSS score of less than 1% indicates that real‑world exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score reflects that the flaw requires an authenticated session with the LMS and the ability to target a particular user. Based on the description, it is inferred that the likely attack vector involves luring a legitimate user to a crafted link that submits a forged request. Because the vulnerability is not actively exploited at scale, the risk remains low, but the potential for unauthorized LMS changes remains.