The Login Logger plugin for WordPress contains a Cross‑Site Request Forgery flaw (CWE-352) that allows an attacker to forge requests on behalf of an authenticated user. By sending a crafted request to one of the plugin’s endpoints from a malicious site, a victim who is already logged into the WordPress site can be coerced into interacting with the attacker’s payload. This can result in the attacker performing actions that the user is authorized to execute, such as altering plugin settings or other privileged operations, without the user’s knowledge.

The vulnerability affects the smerriman Login Logger plugin for WordPress. All versions from the earliest release through version 1.2.1 are impacted. WordPress sites that have installed any of these versions of the plugin are potentially exposed.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is below 1 %, suggesting a low probability of widespread exploitation at this time. The plugin is not listed in the CISA KEV catalog. Exploitation requires the victim to be an authenticated WordPress user and to visit a malicious site or otherwise submit a crafted request to the plugin’s endpoints. Because the attacker must encourage user interaction, the risk is moderated by that requirement.