The vulnerability is a Cross‑Site Request Forgery due to missing nonce validation on several administrative functions of the Resource Library for Logged In Users plugin. An attacker can forge a request that, when a legitimate site administrator clicks a link or performs a similar action, will create, edit, or delete resources and categories. Because these changes affect site content and structure, the impact is to tamper with the site’s integrity and availability for administrators and users.

WordPress sites running the Doubledome Resource Library for Logged In Users plugin version 1.5 or earlier are affected. The plugin is provided by the vendor doubledome.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests exploitation is unlikely but possible. The vulnerability is listed as not in CISA KEV, so no known active exploitation is reported. Exploitation typically requires social engineering to get an established administrator to submit a crafted request while authenticated. No additional technical prerequisites beyond the plugin’s missing nonce have been identified, so the attack vector is primarily indirect phishing or malicious link usage.