Cross‑Site Request Forgery (CSRF) is the type of attack that allows an attacker to issue unwanted requests to a web application where the victim is authenticated. In the case of Feedbucket – Website Feedback Tool, a crafted request from a malicious site can cause the plugin to perform actions as the logged‑in user, potentially changing configuration settings or submitting content without the user’s consent. The vulnerability is classified as CWE‑352 and follows the classic CSRF pattern where no verification of the request origin is performed by the plugin.

The Feedbucket – Website Feedback Tool plugin for WordPress, versions up through 1.0.6, are susceptible. Any WordPress installation that uses Feedbucket 1.0.6 or earlier is at risk and may process forged requests without proper CSRF protection.

The CVSS score of 5.4 indicates moderate impact, while an EPSS score of less than 1% suggests that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog, meaning no known successful exploits have been reported to date. Exploitation requires an attacker to lure a victim into visiting a malicious site or to embed a forged request in a page the victim views; it exploits the lack of origin validation in Feedbucket’s request handling.