The affected BirdSeed plugin accepts the 'birdseed_token' GET parameter in its settings page and saves the value to the database without validating a nonce. This deficiency enables any user to post a forged request that changes the plugin’s token configuration. The primary consequence is that an attacker could alter the token used for birdseed interactions, potentially subverting the plugin’s intended functionality or creating a point of entry for further compromise. The flaw is identified as a Cross‑Site Request Forgery weakness (CWE‑352).

The vulnerability applies to all installations of the BirdSeed WordPress plugin from the initial release through version 2.2.0. Any WordPress site that has installed BirdSeed during this period is considered exposed. Administrators using older versions without the fix should be made aware that their sites could allow third‑party actors to tamper with the birdseed token setting.

The CVSS score of 4.3 reflects a low‑to‑moderate risk that does not require privileged access, but it does necessitate an administrator to click a crafted link or form submission. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the exploitation probability is uncertain, yet the attack requires user interaction. The lack of a nonce check means the vulnerability is trivial to trigger for those targeting sites where administrators might be inadvertently tricked into approving an unexpected request.