A high-severity Cross-Site Request Forgery vulnerability in the WPO365 | Login WordPress plugin could allow unauthorized actions to be performed on behalf of authenticated administrators.

The plugin fails to perform adequate CSRF protection, specifically within its Ajax service, allowing an attacker to trick a logged-in user into executing unintended actions without their consent.

Successful exploitation of this CSRF vulnerability could allow an attacker to modify plugin settings or perform administrative actions if an administrator is lured into clicking a malicious link. This could result in unauthorized configuration changes, site-wide security degradation, or further compromise of the WordPress installation. The CVSS score of 8.8 highlights the potential for significant impact on site integrity.

Immediate Action: Update the WPO365 | Login plugin to version 43.3 or later immediately.

Proactive Monitoring: Review WordPress user activity logs for suspicious configuration changes or unexpected administrative actions occurring without clear user intent.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block suspicious requests that lack valid CSRF tokens.

Public Exploit Available: No

Administrators should update the plugin immediately to version 43.3. If an immediate update is not possible, restrict access to the WordPress administrative dashboard to trusted networks to reduce the exposure to CSRF-based attacks.