Cross‑Site Request Forgery (CSRF) in the EasyMe Connect WordPress plugin allows an attacker to forge authenticated requests on behalf of a logged‑in user. Because the vulnerability does not enforce a CSRF check, arbitrary requests that require user authentication can be executed, potentially affecting site data and configuration. The specific actions a compromised account can perform are not described in the advisory, but any operation that the user is authorized to execute could be exploited.

The EasyMe Connect plugin from easymebiz, all releases from its initial version up through 3.0.3, are affected. No other vendors or products are noted as impacted.

The CVSS score of 4.3 indicates low severity and the EPSS score of less than 1 percent suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require a user to be logged into WordPress and visit a malicious site that issues the forged request; the attacker can then conduct any action permitted by the compromised account’s privileges.