A CSRF flaw in the Zalo Official Live Chat plugin allows an attacker to forge authenticated requests on a victim’s behalf, potentially causing unauthorized actions within the WordPress site. The vulnerability is rated with a CVSS score of 5.4, indicating moderate severity, and the description states it affects all versions up to 1.0.0.

The flaw affects the WordPress plugin Zalo Official Live Chat from vendor nghialuu, versions from n/a through 1.0.0. Site owners using these plugin versions are at risk if users are logged in.

Because the flaw relies on CSRF, an attacker must convince a logged-in user to visit a malicious link or embed a crafted request; the EPSS score of less than 1% suggests low exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The risk remains moderate but is confined to scenarios where a target user is authenticated and the plugin’s sensitive actions lack proper CSRF protections.