The True Ranker WordPress plugin lacks nonce validation on the seolocalrank‑signout action, allowing attackers to forge a request that disconnects an administrator's True Ranker account. This CSRF vulnerability permits unauthorized manipulation of the plugin’s authentication state and can disrupt SEO management functions. The flaw does not grant direct code execution or data exfiltration.

The vulnerability affects the True Ranker plugin from optimizza, versions up to and including 2.2.9. Users running any of these releases on WordPress sites are at risk.

The CVSS score of 4.3 indicates moderate severity, with an EPSS of less than 1%, suggesting a low probability of widespread exploitation. The attack requires that an unauthenticated adversary coerce an administrator into clicking a crafted URL or form, making social engineering a key prerequisite. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, further implying limited exploitation potential.