The vulnerability is a classic Cross‑Site Request Forgery flaw that arises because the plugin does not validate the WordPress nonce when updating its settings. As a result, an attacker can craft a forged HTTP request that, if successfully delivered to the administrative interface, will modify the Keybase verification text stored by the plugin.

This weakness affects the Keybase.io Verification plugin developed by jamesits, which is available for WordPress installations. All plugin releases up to and including version 1.4.5 are susceptible. Administrators of WordPress sites that have installed any of these affected versions are therefore exposed.

The CVSS score of 4.3 indicates a medium severity level, but the EPSS score of less than 1% shows that real‑world exploitation is currently very unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to trick a site administrator into clicking a malicious link or otherwise submitting a forged request; the configuration requires the target to be logged in with administrative privileges. While the potential impact is limited to the internal verification text, the lack of authentication checks means the attacker can alter or remove verification content, undermining the plugin’s integrity.