The IndieAuth WordPress plugin suffers from a CSRF vulnerability due to absent nonce verification on critical authorization functions. Attackers can exploit this by crafting forged requests that cause logged-in users to unknowingly approve OAuth authorization for malicious applications. This leads to unauthorized issuance of access tokens, granting attackers the ability to perform actions such as creating, updating, or deleting content under the victim's identity. The vulnerability affects all versions up to 4.5.4 and has a CVSS 3.1 base score of 8.8, indicating high severity.

An attacker can coerce authenticated users into authorizing OAuth tokens for attacker-controlled applications without their consent. This results in the attacker gaining access tokens with high privileges (create, update, delete), allowing them to take over the victim's account and perform unauthorized actions within the scope of the granted permissions. The compromise affects confidentiality, integrity, and availability of the victim's account and associated data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions of the IndieAuth plugin and consider disabling the plugin if possible. Monitoring for updates from the IndieWeb project or WordPress plugin repository is recommended to apply any forthcoming official fixes promptly.