The vulnerability is a CSRF flaw in the WordPress plugin Contact Form 7 Select Box Editor Button, allowing attackers to submit forged requests on behalf of an authenticated user. This defect, identified as CWE‑352, lets malicious actors cause unintended actions without the victim’s consent.

Affected systems include WordPress sites that have installed Benjamin Pick’s Contact Form 7 Select Box Editor Button plugin version 0.6 or earlier. The plugin is the primary product described by the CNA, with no specific version list beyond the <=0.6 cutoff.

The CVSS score of 4.3 rates the flaw as moderate severity, and the EPSS score indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Although the attack vector is likely a remote domain that tricks a logged‑in user into visiting a crafted URL, no direct access from external hosts is required. Control of the affected form’s submission endpoint is a prerequisite for exploitation.