The WP Add Active Class To Menu Item plugin contains a Cross‑Site Request Forgery flaw (CWE‑352). When a user who is logged into the WordPress site is tricked into visiting a malicious page, the attacker can craft a request that the vulnerable plugin will accept, allowing the attacker to alter navigation menu items or other settings that the plugin manages without the user’s knowledge. No direct code execution is possible, but the flaw permits unauthorized state changes limited to the plugin’s functionality.

The defect affects the WP Add Active Class To Menu Item plugin version 1.0 and all earlier releases, developed by Aftab Ali Muni. Every WordPress site that has installed this plugin and has at least one authenticated user is potentially vulnerable. No other WordPress components are mentioned as affected by this issue.

With a CVSS score of 4.3 and an EPSS score of less than 1%, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user on the target site and a crafted request from an attacker‑controlled domain. An attacker could modify the website’s navigation or appearance, but the impact remains confined to the plugin’s scope.