A cross‑site request forgery flaw exists in the I Order Terms plugin for WordPress. Based on the description, it is inferred that the vulnerability permits an attacker to induce a logged‑in user to unknowingly submit state‑changing requests to the site, potentially violating the integrity of the site’s data. The weakness is classified as CWE‑352. No further specific impact on orders or financial loss is documented in the supplied information.

WordPress sites that use the I Order Terms plugin version 1.5.0 or earlier. The plugin is distributed by Igor Jerosimić. No additional operating‑system or WordPress version constraints are mentioned.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of < 1 % suggests a very low probability of exploitation at present, although actors with expertise could still target the flaw. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a browsing‑time CSRF attack that requires the victim to be authenticated to the WordPress site and to trigger a state‑changing action within the plugin. Because the attack depends on user interaction, the chance of immediate exploitation is low, yet administrators should act to eliminate the risk.