The Simple Statistics for Feeds plugin contains a CSRF weakness that allows an attacker to craft a request that is executed under the identity of a logged‑in user. A victim who visits a malicious page while authenticated to the target WordPress site can trigger the insecure operation, potentially altering plugin settings, data, or other site content. The flaw is identified as CWE-352 and carries a moderate CVSS score of 4.3.

WordPress plugin "Simple Statistics for Feeds" by Jeff Starr, versions up through and including 20250322, are affected.

The CVSS score of 4.3 suggests moderate severity, while the EPSS score below 1 percent indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is known. Attackers would need a victim who is authenticated on the target site and a vector to embed or trigger the forged request, making it a user‑dependent, low‑visibility attack.