The NextScripts: Social Networks Auto-Poster plugin for WordPress contains a CSRF vulnerability due to inadequate nonce validation on the nxssnap-reposter page. This flaw enables attackers to craft malicious requests that, if executed by an authenticated site administrator, can result in deletion of posts or pages without proper authorization. The vulnerability affects all versions up to and including 4.4.3. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

An attacker can cause an authenticated site administrator to unknowingly delete arbitrary posts or pages by tricking them into clicking a malicious link or performing a similar action. This leads to integrity and availability impacts on the affected WordPress site content. There is no confidentiality impact reported. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or content that could trigger actions in the plugin. Monitoring vendor channels for updates and applying any forthcoming patches promptly is recommended.