Cross‑Site Request Forgery (CSRF) is possible in Flipdish Ordering System versions 1.5.2 and earlier. The flaw allows a malicious actor to send a forged request that authenticates as a logged‑in user and alter the plugin’s settings. This can result in unintended configuration changes, potentially exposing the site to further attacks or altering normal operation. The vulnerability reflects the classic CSRF weakness described by CWE‑352 rather than exposing code execution or data exfiltration.

The issue affects the Flipdish Ordering System plugin for WordPress, specifically all releases up through version 1.5.2. Users of earlier or newer versions are not impacted.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the near term, and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated, privileged user—such as an administrator—to be tricked into visiting a crafted link or loading a malicious page. Therefore, while the impact is limited to unauthorized configuration changes, the risk can be mitigated by patching or applying protective measures.