A vulnerability in Moodle's XML grade import feature allows unauthorized grade modification due to missing CSRF token validation. An attacker can exploit this by tricking an authenticated user with grade management permissions into visiting a malicious webpage, causing unauthorized grade changes.