The vulnerability is a classic CSRF flaw (CWE‑352) that allows an attacker to submit form data to the Counter Box plugin’s settings page without the user’s knowledge. If the user is logged in with sufficient privileges, the attacker can alter plugin configuration, potentially disabling site features, changing display settings, or enabling further malicious actions. This change could affect the website’s appearance, behavior, or even expose sensitive information if settings control access levels.

Wow‑Company Counter Box plugin versions up to and including 2.0.5 are affected. The plugin integrates with WordPress sites via the standard admin interface; no other plugins or products are listed as affected.

The CVSS score of 5.4 classifies this as moderate; the EPSS score of less than 1% indicates very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a user who is benched or logged into the site and visiting a malicious page that submits a forged POST request to the plugin’s settings endpoint. Exploitation requires that the target user has administrative or editor privileges on the WordPress installation.