The plugin’s marquee deletion endpoint lacks nonce validation, allowing a Cross‑Site Request Forgery attack. An unauthenticated adversary can create a forged request that, when triggered by a site administrator—such as clicking a malicious link—removes any marquee from the site. This flaw gives the attacker control over content deletion without direct site access.

Any WordPress installation running tekafran’s Animated Pixel Marquee Creator version 1.0.0 or earlier is affected. The vulnerability targets the marquees_list.php deletion functionality exposed to all users with administrative privileges.

The CVSS score of 4.3 indicates a moderate risk; the EPSS score of < 1% suggests exploitation is unlikely in the wild, and the vulnerability is not yet catalogued in CISA KEV. Attackers would need to trick a site administrator into visiting a crafted URL to exploit the flaw, making it a CSRF‑based attack with a high prerequisite of social engineering.