A Cross‑Site Request Forgery (CSRF) flaw in the WP EasyPay plugin for WordPress permits an attacker to cause an authenticated user to perform actions they did not intend. The vulnerability exists in all plugin versions up to 4.5.0 and allows the submission of forged requests to the plugin’s endpoints. Depending on the capabilities exposed by the plugin, this could lead to unauthorized configuration changes or other privileged operations. The plugin does not enforce strong request validation, enabling the injection of malicious state changes.

All releases of the WP EasyPay plugin from Saad Iqbal up to and including version 4.5.0 are impacted. The vulnerability exists in all publicly available builds within that range, and no specific configuration or patch level is detailed beyond the version limit.

The CVSS score of 6.5 indicates moderate severity. An EPSS score of less than 1% signals a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog. The likely attack scenario, inferred from the nature of CSRF, requires a victim who is authenticated to the WordPress site to be induced to submit a malicious request to the plugin’s endpoints, such as via a link or form embedded in a third‑party page.