WordPress plugin Title Experiments Free has a CSRF flaw that lets an attacker craft a request under the guise of a legitimate user. The flaw permits tampering with data submitted to the site, potentially altering plugin settings or other content. The weakness is classified as CWE‑352. No information indicates that the attack would break authentication or expose sensitive data; the primary effect is unauthorized change of state.

This issue targets the kbowson Title Experiments Free plugin for WordPress, affecting all releases from the initial version through 9.0.4 inclusive. Only versions 9.0.5 and newer contain the fix.

CVSS score of 4.3 places this vulnerability in the medium severity range. EPSS of <1% indicates a very low but nonzero likelihood of exploitation, and it is not listed in CISA KEV catalogs. Based on the description, it is inferred that an attacker would need a victim user to be logged in and to follow a crafted link, enabling forged requests that alter plugin data without the user’s knowledge.