The Uptime Robot Plugin for WordPress (versions up to 2.3) contains a Cross Site Request Forgery flaw that allows an attacker to forge requests on behalf of an authenticated user. This could lead to unintended actions performed by the victim, such as modifying plugin settings or other operations that the logged-in user is permitted to execute. The vulnerability is a typical CSRF weakness identified as CWE‑352.

WordPress sites running the Aphotrax Uptime Robot Plugin for WordPress version 2.3 or earlier. No specific earlier versions are listed, so any installation with a version number less than or equal to 2.3 is considered affected.

The CVSS score of 4.3 indicates a medium impact, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of reporting. The issue is not in the CISA KEV catalog. Attackers would need to trick a victim into visiting a crafted page that submits a forged request to the site using the victim’s authenticated session cookies. The weakness does not require elevated privileges and can affect all users with access to the plugin.