The W3Counter Free Real‑Time Web Stats plugin for WordPress contains a CSRF flaw that permits an attacker to send requests to the site that will be processed with the privileges of a logged‑in user. The vulnerability is classified as CWE‑352. While the official description does not enumerate specific affected actions, it states that the flaw allows Cross Site Request Forgery, implying that any state‑changing request visible to an authenticated user could be performed without their knowledge.

The issue affects the WordPress plugin W3Counter Free Real‑Time Web Stats, produced by Dangrossman, for any version up to and including 4.1. Sites that have not upgraded beyond 4.1 remain vulnerable.

The CVSS score of 4.3 indicates medium severity. With an EPSS score of less than 1% and no listing in CISA KEV, the likelihood of widespread exploitation is low. The likely attack vector requires the victim to be authenticated and to click or otherwise access a crafted link that triggers the state‑changing request; this detail is inferred from the nature of CSRF vulnerabilities and not explicitly specified in the CVE description.