The plugin implements an author‑box editing interface without a verification token, permitting a crafted request from another domain to alter the plugin’s configuration or related metadata. An attacker can trigger such a request while a user is logged in, causing the blog to display incorrect author information or other unwanted changes. The vulnerability belongs to CWE‑352.

Sanjeev Mohindra’s Author Box Plugin With Different Description for WordPress is affected in all releases up to and including 1.3.5. The plugin may appear under various installation names but the vulnerability applies across all versions in that range.

The nominal CVSS score is 4.3, indicating a moderate risk if exploited. The EPSS value is below 1 %, suggesting a low likelihood of widespread attacks at present. The vulnerability is not listed in CISA’s KEV catalog. The most likely path involves a malicious site hijacking a logged‑in site administrator’s session to send a forged edit‑author request; it does not require code execution or remote unauthenticated access.