Cross‑Site Request Forgery (CSRF) is present in the Fix Rss Feeds plugin for all releases up to and including version 3.1. The flaw allows an attacker to cause a logged‑in user to execute unintended actions, such as altering plugin settings or otherwise manipulating data. The CVE description does not specify whether a request token is missing or how the CSRF protection was bypassed, so the precise root cause cannot be confirmed, but CSRF typically arises from a lack of request validation.

The vulnerability affects the WordPress plugin "Fix Rss Feeds" by the vendor flyaga. All plugin releases from the earliest available version through version 3.1 are impacted.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of <1% suggests that exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog. Exploitation would require an attacker to lure an authenticated user to submit a crafted request—such as via a phishing link or an embedded form—triggering the unintended action. This attack vector is inferred based on common CSRF exploitation methods, as the description does not detail the exact mechanism.