This vulnerability is a classic CSRF flaw that allows an attacker to force a logged‑in WordPress user to submit crafted requests to the Pixel WordPress Form BuilderPlugin & Autoresponder. By exploiting this, an attacker can perform any action that the victim is authenticated to perform, such as altering form settings, deleting forms, or redirecting traffic. The weakness is identified as CWE‑352, marking it as a failure of protection against tampered requests that can result in unauthorized operations.

The flaw affects the Pixel WordPress Form BuilderPlugin & Autoresponder plugin for all releases through version 1.0.3, any WordPress installation running these versions is potentially vulnerable. Users with versions 1.0.2 or earlier are likewise exposed.

The CVSS score of 5.4 places this vulnerability in the moderate range. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild at the time of this analysis. The vulnerability is not listed in CISA's KEV catalog, further suggesting limited exploitation activity. The likely attack vector is a malicious web page or link that tricks a logged‑in visitor into sending a forged request to the plugin endpoint, leveraging the lack of a valid nonce or token.