The WP2HTML WordPress plugin contains a missing or incorrect nonce validation in its save() function, allowing an unauthenticated attacker to submit a forged request that updates the plugin’s configuration settings. An attacker must entice a privileged site administrator to click a crafted link or visit a malicious page, after which the unverified settings change succeeds. The exploit does not grant code execution, but altering settings can lead to indirect compromises or unwanted behavior within the WordPress environment.

Digital Acorn JP’s WP2HTML plugin for WordPress, versions 1.0.2 and earlier. Users of any WordPress installation running these plugin versions are affected, regardless of other plugins or themes.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score is below 1 %, suggesting a low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers rely on social engineering to convince an administrator to perform a request, meaning the attack vector is user‑interaction‑based and typically does not automatically compromise the site.