The ElasticPress plugin for WordPress has a security issue called Cross-Site Request Forgery. This means that even in the latest version, 5.1.0, there is a risk of unauthorized access. This happens because the do_sync function does not properly check for a security code called a nonce. This allows attackers to manipulate data without being logged in, as long as they can trick the site owner into clicking on a link.