The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to trick an authenticated user into submitting malicious requests to the WordPress site. Because the flaw is present in the Flexible Cookies plugin up to version 1.1.8, the attacker can potentially perform administrative or configuration changes without any authentication. The weakness is categorized as CWE‑352, indicating that the plugin does not properly verify that requests originate from authorized contexts.

WordPress site running the Flexible Cookies plugin by wpdesk, affecting all installations using version 1.1.8 or earlier.

The CVSS score of 4.3 shows moderate risk while the EPSS score of less than 1% indicates a low probability of exploitation in the wild; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote web request that exploits the lack of CSRF protection; an attacker would need the victim to be authenticated and would require the victim to visit a crafted URL or submit a malicious form. Given the low EPSS and moderate CVSS, organizations with the affected plugin should prioritize mitigation but can monitor for related threats.