This vulnerability is a Cross‑Site Request Forgery (CSRF) flaw found in the RadiusTheme Radius Blocks WordPress plugin, affecting all releases up to and including version 2.1.2. Because the plugin does not verify CSRF tokens, an attacker can trick a logged‑in administrator into submitting legitimate requests that perform unintended actions on the site. This could enable unauthorized configuration changes or content manipulation by leveraging a user’s authenticated session.

WordPress sites that include the Radius Blocks plugin from the RadiusTheme vendor, version 2.1.2 or earlier.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to target an authenticated session via the WordPress admin interface; the CSRF flaw allows execution of state‑changing requests without further authentication, making exploitation relatively straightforward once the target is identified.