An unauthenticated or low‑privileged authenticated attacker can exploit a missing authorization check in the WordPress Append Content plugin. The flaw allows the attacker to perform a CSRF attack and change the plugin's settings, potentially altering site behavior or enabling further compromise.

The append-content plugin from Andy Stratton, versions from the earliest released through version 2.1.1, is impacted.

The CVSS score of 6.5 classifies the vulnerability as medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of analysis. The plugin is not listed in the CISA KEV catalog. The likely attack vector is a cross‑site request forgery crafted as a link or form that tricks an authenticated WordPress user into submitting a request that changes plugin settings.