The Related Posts Lite WordPress plugin is vulnerable to a cross‑site request forgery flaw because its settings update process lacks proper nonce validation. An attacker who can entice a logged‑in administrator to click a forged link can cause the site to store altered plugin configuration, affecting how related posts are displayed or other exposed options. This issue does not grant code execution or data exfiltration but can degrade user experience and erode trust in the site.

Any WordPress installation that uses the wpdreams Related Posts Lite plugin version 1.12 or earlier is affected. The vulnerability resides in the admin dashboard settings page and requires a legitimate administrator account to be tricked into submitting a forged request.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score below 1 % suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers would need social‑engineering techniques to persuade an administrator to click a malicious link, so the risk is largely limited to sites employing the vulnerable plugin and lacking user education or additional CSRF controls.