A Cross‑Site Request Forgery flaw in the TOCHAT.BE WordPress plugin enables an attacker to cause a logged‑in user to perform actions automatically without their intent, potentially tampering with chat settings or configuration. The weakness is a classic CSRF (CWE‑352) and carries a CVSS base score of 4.3, indicating a low‑to‑moderate severity.

The vulnerability is present in all published releases of the TOCHAT.BE plugin from the initial version through version 1.3.4, including all intervening builds. The affected vendor is César Martín, and the product is the TOCHAT.BE WordPress plugin.

The EPSS score is below 1 % and the issue is not currently listed as a Known Exploited Vulnerability in the CISA KEV catalog, suggesting that active exploitation is unlikely at present. However, the flaw can be leveraged by embedding a malicious form or link into an external site that the user visits while authenticated, leading to the execution of unintended plugin operations. The lack of a proper anti‑CSRF token or nonce creates a clear attack path for active threat actors with minimal effort.