The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to force authenticated users to perform unwanted actions in the WordPress environment. The flaw is present in all releases of the Songkick Concerts and Festivals plugin up to and including 0.9.7. Because it relies on the victim’s browser session, the attacker does not need to know credentials, but an active session is required.

All users of the saleandro Songkick Concerts and Festivals plugin running any version up to 0.9.7 are affected. No specific versioning beyond 0.9.7 is known to be secure.

The CVSS score of 4.3 suggests a moderate severity. The EPSS score of < 1 % indicates a very low probability of real‑world exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a web page that lures an authenticated user to submit a forged request, so the exploit requires that the target is logged in and the user visits a malicious link or page. Attackers could use phishing or malicious content to trigger the CSRF action.