The Hesabfa Accounting plugin for WordPress contains a Cross‑Site Request Forgery flaw, designated CWE‑352. The vulnerability allows a malicious site to force a logged‑in user to send requests to the plugin’s endpoints, potentially altering or creating accounting records without the user’s explicit permission. Because the exposed actions may modify financial data or perform other privileged operations, the impact can range from data corruption to inadvertent financial liability.

Saeed Sattar Beglou Hesabfa Accounting plugin for WordPress, versions from the initial release through and including version 2.1.8.

The CVSS base score of 4.3 reflects a moderate severity for CSRF, and the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the victim to be authenticated to the WordPress site; an attacker can craft a malicious request that the victim’s browser unknowingly submits, enabling the attacker to perform any action the user can normally execute through the plugin. The risk to each affected site depends on the plugin’s use case—if financial records are being managed, the potential damage is higher.