The vulnerability is a CSRF flaw that enables an attacker to trick a logged‑in user into performing privileged actions within the WordPress site. By crafting a request that the user unknowingly submits, the attacker can invoke the Pearl plugin’s functionality to alter website settings, insert or delete content, or otherwise modify the configuration. The weakness corresponds to CWE‑352, where the lack of a proper token or state verification permits unauthorized state changes.

The flaw affects the Stylemix Pearl header‑builder plugin versions up to and including 1.3.9. Any WordPress installation running this plugin without the latest version is vulnerable.

The CVSS score of 4.3 indicates moderate impact. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to be authenticated to the site and to visit a malicious page carrying the forged request; therefore the attack vector is an authenticated user interaction with a malicious site. Organizations relying on the Pearl plugin should assess whether users normally have elevated roles and consider the risk accordingly.