The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to inject and store malicious scripts into the CAS Maestro plugin’s content. Once stored, the script executes within the context of any user who views the affected content, potentially compromising session data, defacing the site, or facilitating further phishing attacks. The weakness is reflected in the CWE‑352 designation, indicating a lack of proper anti‑CSRF validation during data processing.

Any WordPress installation that has the CAS Maestro plugin from the earliest release up to and including version 1.1.3. The plugin’s author is Henrique Mouta, and the vulnerability applies to all affected releases of this plugin installed on a WordPress site.

The CVSS score of 7.1 classifies this flaw as a high‑severity issue. The EPSS score is below 1 %, indicating a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the CSRF vector by persuading an authenticated user, such as an administrator, to visit a malicious link or submit a crafted form that injects the malicious payload. Because the payload is stored, the impact persists until the content is removed or patched.