The vulnerability in the Super Static Cache plugin allows an attacker to trigger actions on behalf of an authenticated WordPress user without their consent. By exploiting the missing CSRF protections, an attacker can submit requests that change settings or data associated with the victim account, potentially compromising the integrity of the site. The flaw is classified as a CWE‑352 CSRF weakness.

WordPress sites that use the hitoy Super Static Cache plugin version 3.3.5 or earlier are susceptible to the attack. The plugin is specifically listed as a vendor product in the CNA data and the affected versions are those that are <=3.3.5.

With a CVSS score of 4.3 and an EPSS score of less than 1%, this weakness presents a moderate severity but a low probability of widespread exploitation in general. It is not currently listed in the CISA KEV catalog. The likely attack vector is a crafted web page that drives a legitimate user’s browser to perform a request that modifies site data, assuming the user is logged in. No publicly disclosed exploits are noted, and the risk depends largely on the awareness and patch status of site administrators.