A Cross‑Site Request Forgery vulnerability exists in the JExtensions Store WPSpeed plugin. The flaw allows an attacker to trick a logged‑in or otherwise privileged user into submitting requests that perform actions they did not intend, potentially including configuration changes or other state‑altering operations. The weakness is a broken or missing anti‑CSRF mechanism (CWE‑352).

The vulnerability affects the JExtensions Store WPSpeed plugin from any version through 2.6.5. Users running 2.6.5 or earlier on their WordPress sites are exposed.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely. The flaw is not listed in the CISA KEV catalog, implying it is not a widely deployed, actively exploited vulnerability. Based on the description, it is inferred that attackers would need to persuade a legitimate user to visit a malicious page that submits forged requests to the vulnerable plugin, so the attack vector is primarily web‑based and requires user interaction.