The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross‑Site Request Forgery (CSRF) in all versions up to and including 0.9. The flaw arises from missing or incorrect nonce validation in msp‑options.php, allowing an unauthenticated user to modify the plugin's msp_loop_file and msp_nav_location settings when an administrator is tricked into submitting a forged request. This can lead to an attacker altering how the plugin displays posts or navigation, potentially disrupting content organization or user experience.

The affected product is the WP Meta Sort Posts plugin (jasonpitts:WP Meta Sort Posts), all releases with version numbers 0.9 or earlier. Protection is achieved by updating to the latest available plugin release, which addresses the missing nonce validation.

In terms of risk, the CVSS base score is 4.3, indicating a moderate impact level. Exploitation probability cannot be quantified due to unavailable EPSS data, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an attacker to convince a site administrator to click a malicious link or submit a forged form, after which the attacker can change plugin settings. Consequently, administrative users should be aware of this risk and the plugin should be updated or disabled promptly.