The Related Posts Thumbnails Plugin for WordPress contains a Cross‑Site Request Forgery (CSRF) flaw that permits an attacker to trick a logged‑in user into performing unintended actions within the plugin. Because the plugin accepts state‑changing requests without adequate anti‑CSRF tokens, a malicious site can cause a user to submit requests that alter plugin settings or data. This vulnerability aligns with CWE-352 and can lead to unauthorized configuration changes or data manipulation.

Affected systems include any installation of the Related Posts Thumbnails Plugin for WordPress version 4.3.2 or earlier. The plugin is distributed by Marynixie and used by WordPress sites that have installed the plugin via the WordPress plugin repository or direct download. Any site running a vulnerable version is susceptible to CSRF attacks executed by an attacker’s web page.

The vulnerability's CVSS score of 4.3 indicates a medium risk, and the EPSS score of less than 1% suggests a very low current exploitation probability. It is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation at the time of analysis. Based on the description, it is inferred that attackers can exploit the flaw by luring a legitimate WordPress user who has administrative or editor privileges to visit a malicious URL that submits a forged request to the plugin's endpoints.