The Frontend User Notes plugin for WordPress is vulnerable to a Cross‑Site Request Forgery (CWE‑352) that allows an unauthenticated attacker to overwrite a logged‑in user's note. The flaw arises from missing or incorrect nonce validation in the AJAX function funp_ajax_modify_notes, permitting a forged POST request to wp_update_post to replace note content. Because the plugin checks a stored meta field against the current user ID, the attack can modify only the victim's own notes, not those of other users.

All WordPress sites running Frontend User Notes up to version 2.1.1. The plugin must be active and users must be able to create or edit notes for the vulnerability to be exploitable.

The CVSS score of 4.3 indicates a low‑to‑moderate risk. EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited widespread exploitation. Attackers need only persuade a logged‑in user to visit a malicious page; the CSRF can then trigger the note overwrite via a forged AJAX request. The vulnerability is limited by ownership checks, so the impact is confined to the victim’s own notes, but still constitutes unauthorized data modification.