This vulnerability is a Cross‑Site Request Forgery (CSRF) flaw that allows an attacker to forge authenticated requests on behalf of a logged‑in user. The flaw permits the attacker to trigger actions that the plugin permits, potentially leading to unauthorized data modifications or deletion, depending on the capabilities of the OSS Upload plugin. The flaw is identified as CWE‑352 and requires the victim to be authenticated to the site and to have the plugin enabled.

WordPress installations running the OSS Upload plugin at or below version 4.8.9 are affected. The plugin is commonly used to facilitate file uploads within the WordPress admin interface.

The vulnerability is rated moderate with a CVSS score of 4.3, and the EPSS score indicates a very low estimator of exploitation probability (< 1 %). It is not currently listed in the CISA KEV catalog. The likely attack vector is through a standard web request that omits proper CSRF validation; an attacker must convince a legitimate user to visit a crafted URL or submit a form. No additional conditions are listed in the CVE description beyond the plugin version and authentication of the victim.