The vulnerability is a Cross‑Site Request Forgery flaw in the SpeakPipe voicemail plugin. It lets an attacker force an authenticated site visitor to submit a request without the user’s intention, potentially causing unintended changes to voicemail data or actions performed by the plugin. Because the request is forged, the integrity of the plugin’s operations is compromised, and the attacker may achieve data exposure or unauthorized actions.

WordPress sites running the SpeakPipe plugin, any version up to and including 0.2. All installations of the plugin before 0.3 or higher are at risk.

The CVSS score of 5.4 marks the issue as moderate severity, and the EPSS score of less than 1‑% indicates a low likelihood of exploitation. It is not listed in the CISA KEV database. Attackers would need the victim to be logged into the site and to visit a specially crafted page that submits a forged request to the plugin’s endpoints. Because standard CSRF protection is missing, the forged request is accepted by the plugin at the server side.