WordPress sites that run the Copyscape Premium plugin up to version 1.4.1 are susceptible to a Cross‑Site Request Forgery flaw that does not validate state‑changing requests. The weakness allows a malicious site to force an authenticated user to submit forged requests that can modify or delete content, thereby compromising the integrity of the site. This is a classic CSRF vulnerability identified as CWE-352 and can be used to perform any operation that the compromised user is authorized to execute.

Any WordPress installation that includes the Copyscape Premium plugin and is running a version equal to or earlier than 1.4.1 is affected. The flaw applies across all sites using the plugin regardless of other security configurations, and the vulnerability remains unless the code is removed or updated beyond that version.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user to be tricked into visiting a malicious site that submits a forged request, which is a typical CSRF attack vector inferred from the nature of the flaw. Only users who are logged in with sufficient privileges can be targeted, but the impact could still be significant if the site’s core content or critical settings are altered.