The Auto Load Next Post plugin by Sébastien Dumont, up to version 1.5.14, contains a CSRF vulnerability that could allow an attacker to perform unauthorized actions by exploiting the trust of an authenticated user. The vulnerability does not require privileges and has a low attack complexity but requires user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported. No official patch or remediation details are currently available.

The vulnerability allows an attacker to induce an authenticated user to perform unintended actions within the Auto Load Next Post plugin context, potentially altering data or settings. There is no reported impact on confidentiality or availability. The medium severity reflects the limited scope and requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling the plugin or limiting its use to trusted environments. Implementing standard CSRF protections such as verifying tokens on state-changing requests may reduce risk if feasible.