Sent throughyour browser.
While you are signed in to your site, your browser carries your login everywhere. This flaw lets another site use that to make changes in your name.
What it is
Once you sign in, your browser shows your site that it is you on every request, without asking. A well built site also checks that a change came from one of its own pages. With this flaw it does not, so another page can quietly send a change, and your site accepts it as yours.
What could happen to your site
Anything you could do while signed in: add a new administrator, change the site's email address, switch a setting off, or install something. You would see nothing happen. You only have to open the wrong page, or a link in an email, while signed in.
How likely it is
Very common in WordPress plugins, especially in settings pages. It needs a signed in administrator to be tricked into opening a page, which is why most are graded Minor or Major. Signing out when you have finished, or using a separate browser for your site's admin, makes it much harder.
How it gets fixed
The software is changed to put a secret, one time code in each of its own forms, and to refuse any change without it. Another site cannot know the code. For you, the fix is the update.
What to ask your developer
Send whoever looks after your site this:
Ask your developer“The Mendbird report says some of our software has a forged request flaw. Can you update it to the fixed version?”