A Cross‑Site Request Forgery flaw exists in the WordPress CWW Companion plugin up to and including version 1.3.2. The vulnerability allows a malicious actor to trick an authenticated user into submitting crafted HTTP requests that the plugin processes as legitimate actions, potentially altering site settings or performing privileged operations without the user’s consent. The weakness is defined as CWE‑352.

The flaw affects WordPress installations running the CWW Companion plugin from the earliest release through version 1.3.2 inclusive. Users deploying these plugin versions are vulnerable regardless of other security controls in place.

The CVSS score of 4.3 indicates moderate impact; the EPSS score of < 1% suggests very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web request: an attacker must get the victim, who is logged into the WordPress site, to load a malicious URL or click a link that submits a request to the plugin’s admin interface. If the victim is an administrator or user with sufficient privileges, the forged request can alter settings or trigger actions intended for that user.