A Cross‑Site Request Forgery flaw exists in the Mihdan: No External Links WordPress plugin that allows a malicious site to force an authenticated user to submit a request the plugin processes without verifying a CSRF token. The vulnerability enables the attacker to trigger state‑changing actions on the WordPress site if the plugin accepts privileged requests. The weakness is identified as CWE‑352 and is described in the CVE report as permitting CSRF attacks.

WordPress installations that use the Mihdan: No External Links plugin are affected. The issue applies to every released version from the earliest available up to and including version 5.1.6.2. Versions newer than 5.1.6.2 contain the fix, as indicated by the plugin’s update history.

The CVSS score of 5.4 indicates moderate severity for a CSRF vulnerability. The EPSS score of less than 1 percent suggests a very low probability of exploitation currently. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious website or email that convinces a logged‑in user to visit a crafted URL or click a link, causing the user’s browser to send a forged request to the vulnerable plugin’s endpoints without a valid CSRF token.