The WP Multistore Locator plugin for WordPress contains a Cross‑Site Request Forgery flaw that lets an attacker trigger privileged actions on behalf of a logged‑in user. The weakness is identified as CWE‑352 and can compromise the confidentiality, integrity or availability of the site if an attacker can send crafted requests from an authenticated user. The flaw arises because the plugin does not validate that the request originates from a legitimate source or include an anti‑CSRF token.

WordPress installations running the WP Multistore Locator plugin version 2.5.2 or earlier are affected. This includes all sites from the earliest release through 2.5.2 as noted by the CNA vendor WPExperts.io.

The CVSS score of 4.3 indicates a moderate impact with limited exploitability. The EPSS score of less than 1% means that the probability of observed exploitation in the wild is currently very low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker tricking a logged‑in user into visiting a malicious page that submits a forged request to the plugin’s endpoint. The vulnerability requires that the victim have sufficient privileges on the WordPress site to perform the action that the plugin allows.