This flaw allows an attacker to forge requests that a victim’s browser will send to the site, exploiting the WP Ultimate Tours Builder plugin to perform actions on the user's behalf. The attacker can cause the plugin to execute changes or actions as if the authenticated user had initiated them, potentially compromising data integrity and account functions.

WordPress sites that run the loopus WP Ultimate Tours Builder plugin version 1.055 or earlier are affected. The vulnerability applies to all releases in that range; the product name is WP Ultimate Tours Builder and the vendor is loopus.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests exploitation is unlikely at the moment, and the vulnerability is not in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker sending a crafted request from an external site that a logged‑in user would execute in their browser, taking advantage of insufficient CSRF protection in the plugin.