Yet Another Related Posts Plugin for WordPress (YARPP) contains a flaw as HTTP requests to the yarpp page, as called by /wp-admin/options-general.php, do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to manipulate option settings.