A cross‑site request forgery flaw exists in the Old Posts Highlighter plugin for WordPress in all releases up to and including 1.0.3. The issue stems from missing or incorrect nonce verification in the OPH_options handler, allowing an attacker to send forged requests that alter the plugin’s settings. Because the change is performed without proper authentication checks, an unauthenticated attacker can modify configuration such as display options or other plugin behavior, potentially impacting site visibility and user experience.

WordPress sites that have the Old Posts Highlighter plugin installed at version 1.0.3 or earlier. The plugin is distributed under the mkhfr project and is used to highlight archived posts.

The CVSS base score is 4.3, indicating a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed. Exploitation requires a victim administrator to click a malicious link or otherwise submit a forged request, meaning the attack relies on social engineering rather than automated exploits. The likelihood of attack is moderate due to the human‑interaction prerequisite, but the consequences for settings modification are still significant.