A CSRF vulnerability exists in the Display Template Name WordPress plugin version 1.7.1 and earlier, allowing an attacker to trick a logged‑in user into submitting a request that the plugin processes without the user's explicit consent. The flaw does not lead to code execution but can be used to alter site settings or perform other privileged actions, resulting in unauthorized changes. The weakness is classified as CWE‑352, indicating a lack of proper anti‑CSRF protection.

The vulnerability impacts WordPress sites that use the A. Chappard Display Template Name plugin, specifically versions up to and including 1.7.1. No additional version details are provided beyond this upper bound. Sites running newer releases are not affected.

The CVSS score of 4.3 reflects a moderate impact with limited user interaction. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would typically require the victim to be authenticated to the site; the attack vector is client‑side, relying on a malicious web page or email that causes the victim to submit a request that the plugin trusts.