The Easy Social Feed plugin for WordPress suffers from a CSRF vulnerability due to improper or missing nonce validation on the esf_insta_save_access_token and efbl_save_facebook_access_token functions. This flaw allows an attacker to forge requests that, if executed by an authenticated administrator, can link attacker-controlled Facebook or Instagram pages to the affected WordPress site. The vulnerability affects all versions up to 6.5.4 and is classified under CWE-352. The CVSS 3.1 base score is 5.4, indicating a medium severity impact primarily due to the requirement of user interaction and limited impact on confidentiality but potential impact on integrity and availability.

Successful exploitation allows an attacker to connect their Facebook and Instagram pages to the vulnerable WordPress site without proper authorization, potentially enabling unauthorized social media content integration or manipulation. The vulnerability does not directly expose confidential data but can affect the integrity of the site’s social feed content and availability. Exploitation requires tricking a site administrator into performing an action, such as clicking a crafted link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution by avoiding clicking on untrusted links while logged into the WordPress admin interface. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches addressing this CSRF vulnerability.