The RDP Wiki Embed plugin contains a CSRF flaw that allows a malicious actor to craft a request that the WordPress site will process as if it originated from an authenticated user, thereby enabling the attacker to submit unwanted actions on the site without the user’s knowledge or approval.

All installations of Robert D Payne’s RDP Wiki Embed plugin with a version of 1.2.20 or earlier are affected. Site owners should verify the exact plugin version and ensure it falls within this vulnerable range.

The CVSS score of 4.3 places the issue at moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation. Attackers would likely need an authenticated user to visit a crafted URL or submit a malicious form that triggers the vulnerable plugin’s functionality.