The vulnerability arises from a missing nonce validation in the alex_user_counter_function() function of the Alex User Counter WordPress plugin. This flaw permits an attacker to forge HTTP requests that change plugin configuration without authentication. If exploited, an attacker can alter plugin settings such as counters, display options, or potentially inject malicious data, impacting the site's behavior and possibly compromising the user experience.

Any WordPress site that has the Alex User Counter plugin installed with a version of six point zero or earlier is affected. The issue applies to the plugin regardless of other security measures in place, because the plugin itself lacks nonce verification.

The CVSS v3.1 score of 4.3 indicates moderate severity. The EPSS score of less than 1 percent suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can leverage the flaw by tricking a site administrator into clicking a crafted link or submitting a forged form, which circumvents authentication controls solely at the plugin level. Because the flaw requires an administrator to be present on the site, the attack vector is primarily social engineering combined with a simple HTTP request.