Cross‑Site Request Forgery (CWE‑352) is reported in the Feather Login Page plugin. The flaw permits a malicious site to trick a logged‑in WordPress user into sending authenticated requests to the plugin. Because the plugin does not verify user intent, an attacker can cause the user to execute any operation the plugin supports without the user’s explicit permission. The CVSS score of 4.3 reflects a moderate impact due to the potential for unauthorized plugin actions.

All installations of PluginOps Feather Login Page through version 1.1.7 are affected. No newer releases have been confirmed to contain a fix.

The EPSS score is less than 1 %, indicating a low likelihood of exploitation in the wild, and the issue is not cataloged by CISA in KEV. Exploitation requires that a user be authenticated to WordPress and that the attacker successfully entice the user to submit a forged request from a malicious site or crafted payload. Consequently, the risk is primarily to those users who visit untrusted web content while logged into the site, characterizing the threat as a low‑probability, moderate‑severity internal compromise scenario.