A Cross‑Site Request Forgery flaw in the axew3 WP w3all phpBB WordPress integration allows an attacker to inject arbitrary JavaScript that will execute in the browser of a user who submits a forged request. Once the payload runs it can steal session cookies, perform account takeover, or deface a site, compromising confidentiality, integrity, and availability of the application.

WordPress sites that have installed the axew3 WP w3all phpBB plugin version 2.9.9 or earlier are vulnerable. The plugin integrates phpBB functionality into WordPress and is used by administrators to manage forum posts from within WordPress.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1 % suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. It is most likely exploited through a CSRF attack, where an attacker lures a logged‑in user with sufficient privileges to submit a crafted request that triggers the XSS payload. No additional configuration or network conditions are required beyond the normal functionality of the plugin.