The WP Media File Type Manager plugin has a Cross‑Site Request Forgery weakness that permits a user who is already authenticated to submit a request to the plugin’s settings endpoint without a valid CSRF token. This flaw, classified as CWE‑352, enables the alteration of plugin configuration silently by an attacker who can bring the administrator to a crafted page.

Any WordPress installation running Seerox WP Media File Type Manager plugin version 2.3.1 or earlier is affected. The attack requires that the target user be logged in with sufficient privileges to change the plugin’s settings.

The vulnerability has a CVSS score of 4.3, indicating a moderate risk. Its EPSS score is under 1%, suggesting a low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. An attacker would need to trick an authenticated user—most likely an administrator—to visit a malicious URL that submits a request to the vulnerable endpoint. The lack of anti‑CSRF protection makes the exploitation straightforward once the conditions are met.