The vulnerability allows a Cross‑Site Request Forgery attack against the RSTheme Ultimate Coming Soon & Maintenance plugin. An attacker can craft a forged request and cause an authenticated user to perform privileged actions on the website, potentially altering site behavior or configuration without the user’s consent.

RSTheme Ultimate Coming Soon & Maintenance plugin, version 1.0.9 or earlier, is affected on all WordPress installations running these versions.

The CVSS score of 4.3 places the vulnerability in a moderate severity band, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in CISA KEV. An attacker would need to lure a logged‑in user to a malicious site or otherwise submit a forged request; the attack vector is inferred from the CSRF nature of the flaw.