WPVN wpvn-username-changer contains no protection against cross‑site request forgery, allowing an attacker to craft a request that is processed as if it originated from an authenticated user. This leads to unauthorized changes of user account details such as usernames. The weakness is a missing or improperly validated CSRF token, classified as CWE‑352. The primary impact is the corruption of user data integrity and potential loss of trust in the application.

WordPress sites running the Trân Minh‑Quân WPVN plugin with a version equal to or earlier than 0.7.8 are affected. Versions newer than 0.7.8 contain the mitigated code.

The CVSS score of 4.3 represents moderate overall risk, emphasizing the impact on data integrity for authenticated users. The EPSS score is below 1%, indicating little evidence of current exploitation. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an authenticated user visiting a malicious site that submits a forged request to the vulnerable plugin endpoint, exploiting the missing CSRF protection.