This vulnerability arises in the CubeWP plugin for WordPress, allowing an attacker to perform Cross‑Site Request Forgery attacks on all versions up to and including 1.1.29. An impersonated user or a malicious link can cause the plugin to change its configuration without the user’s consent, potentially leading to unwanted content management changes or exposure of sensitive data. The flaw is a classic CSRF weakness, identified as CWE‑352.

WordPress sites running the CubeWP all‑in‑one dynamic content framework plugin, version 1.1.29 or older, created by Imran Tauqeer. Any WordPress installation that has not yet updated beyond that version is exposed.

The CVSS score of 4.3 indicates a moderate risk. The EPSS score is less than one per cent, showing a very low probability of exploitation, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to lure a logged‑in user to a crafted request lacking a CSRF token; therefore, the likely attack vector is a web‑based request from a compromised or spoofed session.