The Stockie Extra WordPress plugin contains a CSRF flaw that permits an attacker to cause authenticated users to perform unintended actions. By forging a request that includes the victim’s credentials, an attacker can manipulate the site’s state, potentially altering content or settings. This weakness is classified as CWE‑352 and directly impacts the integrity of the WordPress installation.

The vulnerability affects the Stockie Extra plugin from all versions through 1.2.11. It is delivered by the vendor colabrio. Any WordPress site that has a vulnerable Stockie Extra plugin installed is impacted.

The CVSS score is 4.3, indicating moderate severity, and the EPSS score is below 1 %, implying a low probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires a logged‑in user’s browser to be tricked into sending a forged request, so attackers rely on social engineering or malicious links rather than direct code execution. Because the EPSS score is low, the likelihood of exploitation in the wild is currently limited, but the risk rises if the plugin remains unpatched on sites with active administrators.