The vulnerability is a Cross‑Site Request Forgery flaw in the MetricThemes Munk Sites WordPress plugin that permits an attacker to trigger the plugin to install arbitrary WordPress plugins. Based on the description, it is inferred that an attacker could install a malicious plugin that runs with the site administrator's privileges, potentially enabling unauthorized code execution and compromising site integrity.

WordPress sites running the MetricThemes Munk Sites plugin version 1.0.7 or earlier are affected. Any site administrator who can log into the WordPress admin dashboard and is not protected by additional CSRF defenses may be at risk.

The CVSS score of 9.6 places this vulnerability in the critical range, while an EPSS score of 1% indicates a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can exploit this remotely by tricking an authenticated administrator into clicking a crafted link or running a script that forces the plugin to install an arbitrary plugin.