The Live Sports Streamthunder plugin for WordPress contains a flaw where a missing anti‑CSRF token verification allows an attacker to force an authenticated visitor to submit a request that performs actions on the site without the visitor’s consent. This weakness falls under CWE‑352 and can lead to unauthorized changes to plugin settings or content, compromising the integrity of the affected WordPress installation.

The vulnerability affects the marcusjansen Live Sports Streamthunder plugin from its earliest available release up through version 2.1. Any WordPress site that has this plugin installed and has not been updated beyond 2.1 is susceptible.

The CVSS score for this issue is 4.3, indicating moderate severity. The EPSS score of less than 1% suggests a low probability of current exploitation, and the flaw is not listed in the CISA KEV catalog. Although the CVE description does not detail an explicit exploitation path, it is inferred from the CSRF nature of the flaw that an attacker would likely need to trick a logged‑in user into visiting a malicious URL that submits a forged request to the plugin’s endpoint.