The flaw is a cross‑site request forgery vulnerability caused by missing or incorrect nonce validation in the dismiss() function of the Ultimate Store Kit plugin. An attacker who can persuade a logged‑in administrator to visit a crafted link can cause the plugin to write arbitrary user‑meta values, typically setting them to “1”, which may lock the administrator account and prevent legitimate access to the site. While the flaw does not provide code execution or direct data theft, it enables a denial of service against a privileged account and can disrupt site administration.

All WordPress sites running the BDThemes Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor plugin version 2.4.1 or earlier are affected. The plugin is released under the free WordPress tier and can be identified by its name and vendor.

The CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1 % suggests a very low likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Exploitation requires an authenticated administrator to click a malicious link, so successful attacks depend on social engineering rather than automated scanning. The CSRF vector can be triggered from any external page, making the vulnerability network‑based but not locally privileged.