The vulnerability is a Cross‑Site Request Forgery flaw that lets an attacker trigger plugin actions on behalf of any authenticated WordPress user without the user’s knowledge. By exploiting the lack of proper request validation, an external actor can cause the plugin to execute actions such as adding or removing contact entries, potentially leading to unauthorized content changes or other admin‑level activities. The weakness is recognized as CWE‑352.

The affected product is the DN Footer Contacts plugin from digireturn. Versions up through and including 1.8.1 are vulnerable. Users running WordPress with this plugin installed are susceptible.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% signals a low likelihood of exploitation as of the latest data. The plugin is not listed in the CISA KEV catalog. The likely attack path involves an attacker sending a crafted URL or embedding a malicious link; when an authenticated user visits that link, the plugin processes the request without adequate CSRF protection, resulting in unintended actions. The overall risk is moderate due to the moderate score, but the low exploitation probability reduces urgency compared to higher‑impact flaws.