The Raychat plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows an attacker to force a logged‑in user to send requests to the site. This can result in the user performing unintended actions such as posting content or changing settings, thereby compromising the integrity of the site. The weakness is classified as CWE‑352, a lack of request validation.

WordPress sites using the Raychat plugin version 2.2.1 or earlier are affected. The vulnerability applies to all releases from the initial release up to and including 2.2.1.

The CVSS score of 4.3 indicates a moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The flaw can be triggered by a simple cross‑site request, typically via a malicious link or embedded form, and requires only that the victim be authenticated. Although the vulnerability is not included in CISA’s KEV catalog, organisations should treat it as a potential risk for integrity compromise and apply remediation promptly.