The Trade Runner plugin (versions up to 3.14) contains a CSRF flaw that allows an attacker to force an authenticated site user to perform unintended actions. By sending a crafted request from a malicious site, the attacker can trigger state‑changing operations such as modifying plugin settings, creating posts, or any other function that the user normally has permission to execute. This can lead to unauthorized changes and potential data tampering.

The vulnerability affects WordPress sites that have the Trade Runner plugin installed, specifically any version from the earliest available through 3.14. Users of earlier or later versions are not affected if a newer release has been issued that removes the flaw.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The vulnerability is not included in the CISA KEV catalogue, reflecting its limited exploitation risk so far. Based on the description, the attack vector is the web interface, requiring a victim user who is logged into the WordPress administration area and whose session token can be coerced by the attacker’s malicious web page. No additional privileges or network access beyond the standard web request are required.