A cross‑site request forgery flaw in the WPSOLR plugin enables an attacker to trigger privileged actions on a WordPress site. Because the plugin does not verify the request origin, a malicious site can trick a logged‑in user into submitting a crafted request that performs actions such as creating users, modifying settings, or accessing sensitive data. The flaw therefore permits compromise of the site’s confidentiality, integrity, and availability.

WordPress installations that have the WPSOLR plugin installed in a version up to and including 24.0. The vulnerability applies to any release of the plugin from its earliest version through 24.0.

The issue carries a CVSS score of 8.8, indicating high severity. The EPSS score is reported as less than 1%, suggesting that automated exploit traffic is currently low. However, the exploitation requires the victim to be authenticated and to visit a crafted URL, which is a feasible condition for social‑engineering attacks. The vulnerability is not listed in the CISA KEV catalog at present. Because a single successful request can grant privileged capabilities, the risk to affected sites is substantial if the attackers can entice an administrator or otherwise privileged user to open the malicious link.