This vulnerability allows an attacker to perform Cross‑Site Request Forgery, meaning a malicious site can forge requests that a victim’s browser will send to the WordPress site while authenticated. The missing CSRF guard in the Hasina77 Wp Easy Allopass plugin means that actions performed by the plugin could be triggered without the user’s consent. The weakness is catalogued as CWE‑352.

The affected plugin is Wp Easy Allopass provided by the vendor Hasina77. Versions up to and including 4.1.1 are impacted. The vulnerability does not affect other WordPress components or plugins.

The CVSS score of 4.3 rates the vulnerability as medium severity, while the EPSS score of less than 1 % indicates a low probability of exploitation. Because the issue is not listed in the CISA KEV catalog, there is no current evidence of widespread attacks. The likely attack vector is a browser‑based CSRF where the victim visits a malicious page while logged into the affected WordPress site. Based on the description, it is inferred that an attacker can cause the plugin to perform actions without additional authentication.