The vulnerability resides in the WP Database Optimizer plugin, allowing an attacker to forge a request that the plugin will accept as legitimate. A forged request could trigger database optimization tasks or other privileged operations performed by the plugin without the target’s consent. The weakness is a classic CSRF flaw (CWE‑352).

The issue affects the WP Database Optimizer plugin by matthewprice1178, versions up to and including 1.2.1.3. Sites running WordPress that have this plugin installed and enabled are exposed.

The CVSS score of 4.3 reflects moderate impact, and the EPSS score of less than 1% indicates low exploitation probability in the short term. This vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to obtain a victim’s authenticated session, or to craft a phishing link that coerces a logged‑in administrator to visit a URL that triggers the privileged action. Because the attack vector is client‑side, it can be executed without any network intrusion or server‑side compromise. The risk is increased on sites with publicly exposed or otherwise insufficiently protected admin accounts.