A Cross‑Site Request Forgery flaw exists in the MURO External image replace WordPress plugin that permits an attacker to modify the plugin’s settings without the user’s consent. The weakness, identified as CWE‑352, compromises the integrity of site settings controlling how images are handled or replaced and may alter site behavior or expose sensitive media. The impact is confined to configuration changes, not to direct code execution or data exfiltration.

WordPress installations that employ the MURO External image replace plugin version 1.0.8 or earlier are affected, regardless of the WordPress core version in use.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1 % signifies a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to target a visitor who has authenticated to the site and coerce them into submitting a request that changes the plugin’s settings.