The Simple Keyword to Link WordPress plugin contains a CSRF flaw that permits an attacker to cause authenticated users to perform unintended actions within the site. This weakness arises from the plugin’s failure to properly validate request tokens or safeguard against cross‑origin requests, allowing malicious actors to trick administrators or other logged‑in visitors into executing plugin‑level commands. The consequence is the unauthorized execution of plugin functions on the victim’s behalf, potentially altering site content or settings without the user’s consent.

The vulnerability affects the Simple Keyword to Link plugin from Alessandro Piconi. Versions up to and including 1.5 are susceptible; earlier, unspecified versions are also mentioned as vulnerable. Users running WordPress installations that have this plugin installed at or below 1.5 are impacted.

The CVSS score of 4.3 indicates a moderate impact level. The EPSS score of less than 1% suggests a low likelihood that the exploit will be actively used in the wild. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires an authenticated user session, typically an administrator of the WordPress site, and that the attacker can trigger the exploit by crafting a request that the plugin accepts without a valid CSRF token.