The Vimeotheque plugin for WordPress contains a cross‑site request forgery weakness that allows an attacker to cause authenticated users to execute plugin‑initiated actions without their consent. This flaw stems from missing or improperly validated CSRF tokens (CWE‑352). An attacker who can drive a victim’s browser to the vulnerable endpoint can trigger unwanted actions such as changing settings, posting content, or otherwise manipulating data controlled by the site.

The vulnerability affects the Vimeotheque plugin developed by Constantin Boiangiu, versions 2.3.5.2 and earlier. Users running those versions in a WordPress site are at risk.

The CVSS score of 4.3 indicates moderate impact, and the EPSS score of less than 1 % suggests low current exploitation likelihood. The vulnerability is not cataloged in the CISA Known Exploited Vulnerabilities list. An attacker can exploit the flaw by causing an authenticated victim’s browser to request the plugin’s endpoints with crafted data, leveraging the lack of CSRF protection.