The USS Upyun plugin for WordPress allows attackers to perform Cross‑Site Request Forgery because the uss_setting_page function does not correctly validate a nonce when processing the uss_set form type. An unauthenticated attacker can craft a forged request that causes an administrator, lured by a malicious link, to submit a form that changes critical Upyun cloud storage settings—bucket names, operator credentials, upload paths, and image‑processing parameters—without needing to be logged in yourself. This flaw enables an attacker to modify the cloud storage configuration of the site.

WordPress installations that use USS Upyun plugin version 1.5.0 or earlier are affected. The vulnerability exists in all releases up to and including 1.5.0, regardless of other plugin or theme configurations, and specifically targets the settings page handling Upyun integration.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% shows a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not known to be actively exploited in the wild. Likely attack vectors involve a CSRF request presented to an authenticated administrator; the attacker must convince a site admin to click a crafted link or otherwise submit the forged form. Successful exploitation allows the attacker to alter critical cloud storage settings.