The LH Signing WordPress plugin is vulnerable to Cross‑Site Request Forgery because the plugin_options function fails to validate a nonce on every request. An attacker who can trick an administrator into executing a forged request can modify any of the plugin’s settings. This change could be used to alter the plugin’s behavior, potentially weakening site security or redirecting traffic. The type of weakness is identified as CWE‑352, reflecting a failure to verify an attacker’s intent.

WordPress sites that use the LH Signing plugin version 2.83 or earlier are affected. The plugin, developed by shawfactor, is included in the plugin repository and can be installed on any WordPress instance where site administrators manage it.

The CVSS score of 4.3 indicates a moderate level of severity, while the EPSS score of less than 1% suggests a very low exploitation probability at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog, further indicating that no widespread or known exploits are in circulation. The likely attack vector is Cross‑Site Request Forgery; a malicious actor would need to persuade an administrator to click a crafted link or visit a malicious page that submits a forged POST request to the plugin_options endpoint. Because the flaw affects unauthenticated requests that are then executed under the privileges of the admin user, the impact is confined to those privileged users—but once the plugin settings are altered, the attacker could gain broader influence over the site’s operation.