The vulnerability is a cross‑site request forgery in the TZ PlusGallery plugin. An attacker can force a user’s browser to send privileged requests to WordPress without the user’s consent, potentially altering or deleting gallery content. The flaw is a CWE‑352 condition and allows a malicious site to trigger state‑changing operations through the victim’s authenticated session.

The affected product is the WordPress TZ PlusGallery plugin, produced by tuyennv, versions 1.5.5 and earlier. Any WordPress site running this plugin before version 1.5.6 is vulnerable.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it via a crafted web page that exploits the victim’s authenticated session, and the vulnerability requires only a user’s active browser session to be valuable.