The Lenix SCSS Compiler plugin for WordPress has a CSRF flaw that permits attackers to send forged requests to the plugin’s endpoints. This vulnerability allows an attacker to trigger operations on the site that the victim’s browser would otherwise send, effectively enabling unauthorized actions without further authentication. The weakness is represented by CWE‑352.

YoniFre’s Lenix SCSS Compiler plugin, packaged for WordPress, is vulnerable in all releases up to and including version 1.2. Earlier releases are not affected, and newer releases (if any) are presumed patched. The plugin is commonly installed on sites that use the Lenix SCSS Compiler to manage SASS compilation.

The CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1% suggests a low likelihood of active exploitation at the time of assessment, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an attacker to target a logged‑in user who has sufficient privileges to access the plugin’s functionality. Because the flaw does not directly allow arbitrary code execution, the impact is limited to the permissions of the victim user.