Cross‑Site Request Forgery (CSRF) vulnerability in the Skrill Official WordPress plugin allows an attacker to craft a request that the victim’s browser will send under the victim’s credentials. The flaw is listed as CWE‑352. An exploited CSRF can let the attacker trigger any function the user is authorized to perform, such as modifying payment settings or initiating transactions, without needing to compromise the user’s account directly.

The vulnerability affects the Skrill Official plugin for WordPress, from any version up to 1.0.66 inclusive, released by Skrill_Team.

The CVSS score of 4.3 signals moderate severity, while an EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not listed in CISA KEV. Exploitation typically requires a victim to visit a malicious link or submit a forged form, meaning an attacker must rely on user interaction. Because the vulnerability is client‑side, the overall risk is moderate but persistent until the plugin is updated.