A cross‑site request forgery flaw in the shen2 多说社会化评论框 WordPress plugin permits an attacker to force a logged‑in user to send requests that alter the plugin’s configuration. The vulnerability, identified with CWE‑352, can be used only when an authenticated account with sufficient privileges interacts with the plugin’s settings interface, and it does not provide direct code execution or privilege escalation.

WordPress sites that have the shen2 多说社会化评论框 plugin installed in version 1.2 or older are affected. The CVE description does not specify any particular WordPress core version or additional components.

The CVSS score of 4.3 indicates a medium impact. The EPSS score of less than 1 percent indicates a relatively low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Attackers would need a user with an active session capable of reaching the plugin’s settings page; no external access or privileged user is required beyond that. Exploitation would only change configuration values, so the window to detection is limited to monitoring of administrative activity.