The plugin contains a missing or incorrect nonce check in the ctf_clear_cache_admin() function, allowing an unauthenticated attacker to craft a forged request that resets the plugin’s cache. This cross‑site request forgery can be triggered by convincing a site administrator to click a link, resulting in an unexpected cache purge that disrupts the display of tweets. The vulnerability stems from a classic CSRF weakness (CWE‑352).

WordPress sites running the Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin, version 2.2.5 or earlier. No other products or versions are affected.

The CVSS score of 4.3 classifies the issue as moderate, and the EPSS score of less than 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, meaning no public widespread exploitation is known. Attackers need only lure an administrator to visit a crafted link; no credentials or advanced privileges are required. The risk, while low in probability, is tangible as it forces an administrator to rebuild cache and possibly causes temporary content loss.