The HidePost plugin suffers from missing or incorrect nonce validation on its options.php settings page. This flaw lets an unauthenticated attacker forge a request that, if an administrator performs a simple action such as clicking a link, will modify the plugin’s configuration. The change can influence how posts are hidden or shown, potentially altering site content visibility. The underlying weakness is classified as a Cross‑Site Request Forgery, CWE‑352.

The vulnerability applies to the HidePost WordPress plugin from the vendor funnnny, specifically all releases up to and including version 2.3.8. WordPress sites that have this plugin installed and are running those version numbers are susceptible.

The CVSS score of 4.3 indicates a medium impact when the flaw is exploited. The EPSS score of less than 1% suggests that exploitation is currently very unlikely. The flaw is not listed in the CISA KEV catalog. An attacker would need to compromise the administrative browser session of a site owner or trick an administrator into following a malicious URL that performs the forged request. Once executed, the attacker can alter plugin settings without needing further privileges.