WordPress OpenHook thesis‑openhook plugin is susceptible to Cross‑Site Request Forgery attacks. An attacker can craft malicious requests that the plugin accepts without proper validation, allowing them to perform actions on behalf of a logged‑in user. This can lead to unauthorized changes to configuration, data loss, or other harmful alterations controlled by the attacker. The weakness is classified as CWE‑352.

The vulnerability affects the OpenHook plugin distributed by Rick Beckman for WordPress, specifically all releases through version 4.3.1 inclusive. Any site running that version of the plugin is potentially vulnerable.

The CVSS score of 5.4 indicates a moderate severity level, and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is listed as not in the CISA KEV catalog. Attackers can exploit the flaw simply by luring an authenticated user to visit a malicious page, therefore the attack vector is browser‑based. Successful exploitation requires the victim to be logged into the WordPress site when the forged request is sent. Once the request is processed, the attacker can perform any action that the authenticated user is permitted to do.