Cross‑Site Request Forgery (CSRF) in the digireturn Simple Fixed Notice WordPress plugin allows attackers to trick authenticated users into performing unintended actions. The vulnerability, identified as a CWE‑352 weakness, permits sending crafted requests to the plugin’s endpoints while a legitimate user is logged in, potentially changing cookie notice content or settings. It enables an attacker to alter the plugin’s configuration without the user’s direct knowledge.

The flaw affects the WordPress plugin digireturn Simple Fixed Notice (dn‑cookie‑notice) version 1.6 and earlier. Sites running any of those versions of the plugin are vulnerable.

The CVSS score of 4.3 reflects moderate impact, while an EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely target the plugin by directing a logged‑in user to a malicious URL or form that automatically submits to the plugin’s endpoint. No advanced prerequisites are noted; the attack path is straightforward where CSRF protection is absent.