The Breaking News WP plugin contains a Cross‑Site Request Forgery flaw that lets an attacker change plugin settings without proper authorization. By directing an authenticated user to a specially crafted URL, the attacker activates the plugin’s settings update endpoint which lacks CSRF protection. The vulnerability is classified as CWE‑352 and carries a CVSS score of 6.5, indicating moderate severity. Attacker gains the same rights as the victim, enabling stealthy configuration changes such as disabling notifications or altering the plugin’s behavior.

WordPress sites running Breaking News WP from doit with any version up to and including 1.3 are vulnerable. All installations of the plugin in that version range are affected.

With a CVSS of 6.5, the flaw is considered moderate, while the EPSS score of less than 1% and absence from CISA’s KEV catalog suggest low current exploitation likelihood. However, the exploit requires an authenticated user with write access, which is common for editors and administrators. A social‑engineering attack or a malicious link can trigger the vulnerability, leading to unauthorized configuration changes that may disrupt site operation or redirect traffic.