The Zawgyi Embed WordPress plugin contains a CSRF flaw in all releases up to and including 2.1.1. A missing or incorrect nonce check in the zawgyi_adminpage function lets an unauthenticated attacker send a forged POST request to options‑general.php?page=zawgyi_embed and modify the plugin’s zawgyi_forceCSS setting. The effect is a change of the CSS output used by the plugin, which can alter the visual presentation of the site and potentially expose sensitive information or mislead users. The CVSS score of 4.3 classifies this as a medium‑severity issue that affects the integrity of the site’s appearance but not the underlying WordPress installation.

This vulnerability affects installations of the Zawgyi Embed plugin for WordPress produced by saturngod, in all versions up to and including 2.1.1. Administrators running these versions are at risk when the plugin’s admin pages lack proper CSRF protection.

With a CVSS score of 4.3 and no EPSS data available, the likelihood of exploitation is moderate. The vulnerability is not listed in CISA’s KEV catalog, indicating no widely known active exploitation. An attacker must socially engineer an administrator to click a malicious link or otherwise trigger the forged POST request, making the attack vector dependent on user interaction rather than remote code execution.