Cross‑Site Request Forgery (CSRF) in the Convers Lab WPSubscription plugin allows an attacker to trick an authenticated user into executing unwanted actions. The vulnerability originates from the plugin’s lack of proper request validation, which can lead to unauthorized changes or data manipulation within the WordPress site. The weakness is identified by CWE‑352 and can result in accidental or malicious modification of subscription data or administrative settings.

WordPress sites that have the Convers Lab WPSubscription plugin installed prior to version 1.9.2 are affected. Versions from the first release up to and including 1.9.1 are vulnerable; the exact starting version is not specified in the report. Administrators should verify the plugin version and plan an update if the installed version is 1.9.1 or lower.

According to the calculations, the CVSS score for this flaw is 4.3, indicating moderate risk. The EPSS score is not provided, so the current probability of exploitation is unclear, and the issue is not listed in CISA’s KEV catalog. Attackers would likely exploit the flaw by sending a crafted request from a trusted user’s browser, making reliance on user login sessions and potentially spoofing request parameters. Because the vulnerability is a CSRF issue, the attack requires the victim to be authenticated and to visit a malicious page; no additional privileges or network access are necessary.