Cross‑Site Request Forgery (CSRF) vulnerability in the WordPress My auctions allegro plugin allows an attacker to force a logged‑in user to perform unintended actions within the plugin, such as posting or modifying auctions, without the user’s consent. The weakness is identified as CWE‑352 and can lead to unauthorized configuration changes or content manipulation, compromising the integrity and trust of the auction platform.

The vulnerability is present in all versions of the My auctions allegro plugin up to and including 3.6.33. WordPress sites that have installed the free edition of this plugin and have not upgraded to the patched release are at risk. The affected software is part of the WordPress ecosystem, so any site that relies on this plugin could be impacted.

The CVSS score of 5.4 indicates moderate severity, primarily due to the lack of authentication requirement on the attacker side but the integrity impact is limited to plugin actions. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to persuade a legitimate user to visit a malicious page that triggers the plugin’s state‑changing endpoints, making the attack vector rely on social engineering rather than direct network exploitation.