The vulnerability is a classic CSRF flaw (CWE‑352) that allows an attacker to submit state‑changing requests on behalf of a logged‑in user. Because the plugin does not perform proper verification of authenticated requests, any action that requires user privileges (such as updating settings or clearing caches) could be performed without the user’s consent. The impact does not include remote code execution but can lead to unauthorized configuration changes or other privileged actions on the WordPress site.

The WordPress plugin Browser Caching with .htaccess, developed by tobias_.MerZ, is affected. All releases from version 1.2.1 onward are vulnerable; earlier versions are not known to contain this flaw.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is reported as <1 %, suggesting that exploitation attempts are currently rare. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a typical CSRF scenario: an attacker must trick an authenticated user into visiting a malicious page or triggering a crafted request that the plugin accepts as a legitimate request. This inference is drawn from the nature of the vulnerability and known CSRF patterns.