The Auto Load Next Post plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows an attacker to send forged requests to the site without the plugin’s CSRF token checks. By exploiting this, an attacker can cause the site to perform administrative actions on behalf of an authenticated user, such as modifying content, settings or user information. The vulnerability does not provide arbitrary code execution, but any changes depend on the attacker’s privileges within the site.

Sébastien Dumont Auto Load Next Post plugin for WordPress, versions up to and including 1.5.14.

The CVSS score of 4.3 indicates moderate impact. The EPSS score of <1% shows a low likelihood of exploitation, and the issue is not listed in CISA KEV. Based on the description, it is inferred that the attacker must target a user with an authenticated session and craft a malicious request, typically via a crafted link or form. While exploitation probability is low, the ability to carry out unwanted actions that rely on user privileges could damage site integrity or reliability.