The vulnerability lies in the auto making JSON‑LD WordPress plugin, where the amJL_certification function performs no or incorrect nonce validation. This flaw allows an unauthenticated user to forge a request that updates the plugin’s license key option. The attacker can then trigger downstream calls to amJL_is_license_valid() and amJL_download_and_install_pro_features(), effectively installing plugin components on the victim site without administrator consent. The weakness is classified as a CSRF flaw (CWE-352) with moderate severity.

The affected product is the auto making JSON‑LD WordPress plugin with versions up to and including 4.5.3. Users who have installed any of these versions are at risk unless they have applied a fix.

This flaw carries a CVSS score of 4.3, indicating moderate impact. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker could exploit the CSRF vulnerability remotely by simply convincing an administrator to visit a specially crafted link or by embedding the forged request in HTML or JavaScript. Once triggered, the attacker gains the ability to alter a sensitive configuration setting and install additional plugin components, potentially escalating privileges or compromising site integrity.