The TM Replace Howdy WordPress plugin contains a Cross‑Site Request Forgery flaw that can allow an attacker to trick an authenticated user into performing unwanted actions on the site. The flaw exists in all releases up to and including 1.4.2 and is known as CWE‑352. An unauthenticated attacker cannot directly exploit it, but anyone who can persuade an authenticated user to visit a crafted URL could change site settings, delete content, or otherwise compromise the site’s integrity and availability.

The vulnerability is present in the TM Replace Howdy plugin distributed by David Wood. All versions from the earliest release through 1.4.2 are affected. Updated versions released after 1.4.2 are not impacted.

The CVSS score of 4.3 rates the issue as moderate. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack path requires an authenticated user to execute a crafted request, often via a spoofed link or form. When the target user follows the link the request is sent with the victim’s authentication cookies, causing the plugin to perform the unwanted action without any additional checks.