The vulnerability is a Cross‑Site Request Forgery flaw in Brizy Pro that allows an attacker to submit state‑changing requests on behalf of an authenticated user. The CVE description states that the plugin permits CSRF, but does not detail the exact token validation logic. The flaw could enable an attacker to add, modify, or delete content or change settings that the victim is authorized to perform.

Brizy Pro plugins with versions 2.6.1 and earlier are affected. Any WordPress installation that has installed Brizy Pro at any release prior to or equal to 2.6.1 is at risk. The vulnerability applies to the Brizy Pro plugin used within WordPress sites.

The CVSS base score of 4.3 indicates low-to-moderate severity, and the EPSS probability of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a web request from an external site that an authenticated user visits, which sends crafted requests to the plugin’s endpoints. No additional system privileges or network access beyond a standard web context are required.