Cross‑Site Request Forgery (CSRF) is an attack that forces an authenticated user to submit a request that the victim did not intend. The vulnerability exists in the ABCdatos AI Content Creator WordPress plugin, affecting all releases numbered 1.2.6 or earlier. Based on the description, it is inferred that an attacker who convinces a logged‑in user to visit a malicious page can trigger the plugin to create or modify content without the user’s knowledge, potentially leading to unwanted content generation or modification.

The vulnerable product is the ABCdatos AI Content Creator plugin for WordPress. All versions up to and including 1.2.6 are impacted. No other WordPress or third‑party products are mentioned, so the scope is limited to installations of this plugin.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1 %, implying a low but non‑zero likelihood of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires a user to be authenticated to the target site and to visit an attacker‑controlled page that sends a malicious request to the plugin.