Takien Rewrite plugin versions up to 0.2.1 contain a Cross‑Site Request Forgery weakness that allows an attacker to submit forged requests without a valid CSRF token, enabling the attacker to execute privileged actions with the credentials of the logged‑in user. This is a CWE‑352 weakness and can lead to data modification, administrative changes, or other unauthorized operations.

All WordPress sites that have the takien Rewrite plugin installed and running a version equal to or older than 0.2.1 are affected. The vulnerability is specific to this plugin and does not compromise other WordPress components directly.

The CVSS score of 4.3 reflects moderate impact with limited privileges. The EPSS score of less than 1% indicates that exploitation is considered unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve a malicious link or form that submits a forged request to the vulnerable plugin; the attacker must have access to a logged‑in session or compel a victim to click the link. Overall risk is moderate but low likelihood of active exploitation.