This vulnerability permits an attacker to forge requests on behalf of an authenticated user within the WordPress site. Leveraging the missing protection mechanism, the attacker could trigger any action that the plugin authorizes without the user’s knowledge, potentially damaging the content or configuration of the site. The weakness is a classic CSRF flaw.

WordPress sites running the Wp Social plugin, version 3.2.3 or earlier. Any site that has installed the plugin up to the stated limit is susceptible, regardless of its overall WordPress version.

The CVSS score of 5.4 indicates a medium severity impact and the lack of an EPSS score means the exact likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure or trick a logged‑in administrator or regular user into visiting a crafted URL or submitting a forged form. If successful, the attacker gains the privileges of that user for the duration of the forged request, which could lead to data alteration or unauthorized administrative actions.