The flaw in NertWorks All in One Social Share Tools stems from missing or improper CSRF token validation. It is inferred that an attacker could craft a malicious request that the WordPress plugin would process as if sent by an authenticated user. Consequently, it is likely that this could lead to unauthorized configuration changes, data manipulation, or other privileged actions without needing credentials. This is a classic CSRF weakness (CWE‑352).

The vulnerability affects the WordPress plugin NertWorks All in One Social Share Tools, all released versions up to and including 1.26. Users running any of these versions are susceptible to exploitation.

The CVSS score of 5.4 categorizes the issue as moderate risk. The EPSS score of less than 1% indicates a low probability of real‑world exploitation at present, and the flaw is not listed in the CISA KEV catalog. It is likely that authentication is not required to invoke the vulnerable endpoints, so the attack path is straightforward once an attacker can reach the site. The lack of a CSRF check is the root cause, and it is inferred that a successful exploit could enable unauthorized configuration changes or data manipulation.