The Typekit plugin for WordPress version 1.2.3 and earlier contains a Cross‑Site Request Forgery flaw that enables an attacker to force an authenticated WordPress user to perform privileged actions. Because the vulnerable endpoint lacks proper CSRF validation (CWE-352), an attacker can trigger these requests without the user’s knowledge, potentially altering site content, settings, or executing arbitrary administrative functions.

WordPress sites that have the lucksy Typekit plugin installed at version 1.2.3 or older are affected.

The CVSS score of 4.3 categorizes the flaw as medium risk, while the EPSS score of <1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the CSRF nature of the flaw, would require a victim to be logged into the WordPress site and to visit a malicious page that submits a crafted request to the plugin’s endpoint.