The ClipLink plugin (indgeek) contains a CSRF flaw that allows a malicious actor to send requests authenticated as a logged‑in WordPress user. Based on the nature of CSRF, the attacker could potentially trigger any action that the authenticated user is permitted to perform, which may affect site content or configuration. The description does not specify exact impact, so this possibility is inferred from standard CSRF behavior.

The vulnerability affects the ClipLink plugin from indgeek, all releases up to and including version 1.1. No specific sub‑versions were listed, so the entire range from 1.0 to 1.1 is impacted.

The CVSS score of 4.3 places the flaw in the low‑to‑moderate range. The EPSS score of < 1% indicates that the likelihood of exploitation in the near future is very low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is web‑based; exploitation requires the victim to be authenticated to WordPress and to visit a malicious site that submits the forged request. No additional system privileges beyond existing authentication are required. The risk is modest, but remediation is advisable.