The vulnerability allows an attacker to forge a request that changes the subscription level of a logged‑in user without the user’s knowledge. Because nonce validation is missing in the set_subscription_level() function, an unauthenticated attacker can construct a link or form that, when visited by an authenticated user, alters that user’s subscription settings. The weakness is classified as Cross‑Site Request Forgery (CWE‑352).

This issue affects the Asgaros Forum WordPress plugin on all releases up to and including version 3.2.1. Any site running the affected plugin, particularly those that rely on the includes/forum‑notifications.php set_subscription_level() function, is susceptible. Installing a newer release removes the flaw.

The CVSS v3.1 score of 4.3 indicates medium severity, and the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation. The vulnerability is not featured in the CISA KEV catalog. Exploitation requires a social‑engineering vector – an attacker must convince a logged‑in user to click a crafted link that submits the forged request. The attack does not provide code execution or direct data theft, but it can disrupt user preferences and potentially undermine the user experience.