The WordPress plugin Anti‑Spam: Spam Protection | Block Spam Users, Comments, Forms is vulnerable to CSRF because it does not validate nonces in key administrative files. An attacker who can trick an administrator into clicking a crafted link can cause the site to delete pending comments or re‑enable a previously blocked user. The weakness, identified as CWE‑352, undermines integrity and availability of content moderation features and allows an unauthenticated user to influence site state.

The vendor webguyio publishes the Stop Spammers Classic plugin. All versions up to and including version 2024.7 are affected; the vulnerability is present in the ss_option_maint.php and ss_user_filter_list files of those releases.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of <1% means that observed exploitation risk is very low, and the issue is not listed in the CISA KEV catalog. The most likely attack vector is a CSRF request that requires the victim administrator to unknowingly approve an action, such as clicking a link, and the vulnerability does not grant additional privileges beyond those of the target administrator.