The Memory Usage plugin for WordPress is affected by a missing nonce validation in its wpmemory_install_plugin() function. This flaw allows an unauthenticated attacker to perform a cross‑site request forgery, causing the plugin to silently install whitelisted plugins when a site administrator is tricked into clicking a forged link. The result is an unauthorized plugin installation, and the vulnerability carries a CVSS score of 4.3.

The affected product is the Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions plugin for WordPress, all versions up to and including 3.98.

The EPSS score is below 1%, indicating a small chance of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a CSRF scenario that requires an attacker to prompt a site administrator to visit a malicious link; the absence of a nonce check makes the request accept without authentication. Because the flaw only permits plugin installation within a whitelist, the scope of damage is limited to the installation of approved plugins.