The vulnerability is a CSRF flaw that permits an attacker to submit forged requests that are processed as if they originated from an authenticated user. Because the plugin does not verify request origin or include a token, an attacker can trigger WordPress operations without the user's knowledge. The impact is the potential for unintended configuration changes or content manipulation, compromising the integrity of the site.

Affected are installations of the CodeVibrant Maintenance Notice WordPress plugin on any WordPress site running version 1.0.6 or earlier. No specific WordPress core version is impacted, but the plugin’s vulnerable state exists across all platforms that include it.

The CVSS score of 4.3 indicates medium severity, and the EPSS score of less than 1% suggests a very low likelihood of commercial exploitation at present. The vulnerability is not listed in the CISA KEV catalog. It is likely exploitable via a web request that a logged‑in user inadvertently submits; the attack vector is inferred to be web-based. Because the flaw requires the victim to be authenticated, the risk is limited to users with sufficient privileges, but it can be used to perform arbitrary actions on the site if the attacker controls the victim’s session or can force the victim to visit a malicious URL while authenticated.