A Cross‑Site Request Forgery (CSRF) flaw in Wow‑Company Popup Box allows an attacker to trick an authenticated user into executing unwanted actions on the WordPress site. The vulnerability exists because the plugin fails to verify a unique, per‑session token on sensitive requests, enabling an attacker to craft a malicious link that will perform the action the user has permission to do.

The affected product is the Wow‑Company Popup Box WordPress plugin, versions up to and including 3.2.4. Any WordPress installation that has this plugin with a vulnerable version is at risk.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests low overall exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog, and it requires that the threat actor obtain a link that the victim visits while authenticated. Once that occurs, the attacker can trigger privileged actions on the victim’s behalf with little additional effort.