The vulnerability is a classic Cross‑Site Request Forgery flaw that allows an attacker to redirect a logged‑in user to perform actions without the user's consent. Because the plugin processes requests without adequate verification, an attacker with a crafted URL can trigger unwanted operations within the site that the user is authorized to perform. The weakness is classified as CWE‑352.

The Advanced Post List plugin by jokerbr313, version 0.5.6.2 and earlier, is affected. Any WordPress installation that uses these versions of the plugin is susceptible.

The CVSS score of 5.4 indicates a medium severity impact. With an EPSS score of less than 1 % the likelihood of exploitation at the current time is low, and the issue is not listed in the CISA KEV catalog. However, CSRF remains a common attack vector on authenticated users, and an attacker that can lure a legitimate user to a malicious link could trigger the vulnerability if no protective tokens or role restrictions are in place.