PublishPress Series EUVD-2026-81516

Exploitation requires an authenticated PublishPress Series user with sufficient privileges (typically administrator or editor) to be tricked into visiting an attacker-controlled page while their WordPress session is active (UI:R). The affected action lacks CSRF/nonce protection in PublishPress Series <=3.1.3. Limiting factors: the attacker cannot act directly (no server-side authentication is bypassed on their own - the victim's session is abused), success depends entirely on social-engineering the victim into clicking, and the impact is confined to low-integrity/low-availability state changes within the plugin's scope (S:U), with no data disclosure.

This is a moderate-severity, not high-priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, base 5.4) describes a network-reachable CSRF that is unauthenticated on the attacker side (PR:N) but critically depends on user interaction (UI:R) - the attacker must lure an authenticated victim (typically an admin/editor) into visiting a malicious page. Impact is deliberately capped at low integrity and low availability with no confidentiality loss (C:N/I:L/A:L), consistent with a CSRF that forges a state-changing plugin action rather than exposing data. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' This is a classic CWE-352 finding disclosed by Patchstack via coordinated disclosure - a real but low-urgency issue, mitigated in practice by the user-interaction requirement and the absence of any weaponization signal. No signals conflict; the vector and description agree.

An attacker crafts a malicious web page containing a forged request targeting a state-changing PublishPress Series action, then lures a logged-in WordPress administrator or editor into visiting it. Because the plugin action lacks proper nonce/CSRF validation, the victim's browser silently submits the request with their session, altering plugin settings or series data. No public exploit code is identified at time of analysis.