This vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to trick an authenticated user into performing unintended actions through the Bulk Product Sync plugin. The impact can be unauthorized product synchronization or other data manipulation, potentially compromising the integrity of a WordPress site. The CVSS score of 4.3 indicates a moderate severity, and the weakness is identified as CWE‑352.

The N‑Media Bulk Product Sync plugin, any installation of version 8.6 or earlier, is affected.

The exploit requires a user with privileges to be tricked into visiting a malicious URL that submits a request to the plugin’s sync endpoint. The EPSS score of <1% indicates a low probability of active exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to convince a human user to perform the request, and the lack of a broader automated vector limits immediate threat but does not eliminate risk.