The vulnerability is a Cross‑Site Request Forgery flaw that allows attackers to induce authenticated users to submit requests that perform actions the attacker intends. Because the flaw utilizes lack of CSRF protection in the DirectoryPress plugin, an attacker can execute spurious operations such as creating, editing, or deleting listings, or any other privileged action the plugin exposes. The weakness is identified as CWE‑352.

Affected systems are installations of the Designinvento DirectoryPress WordPress plugin at version 3.6.22 or earlier. The plugin runs within any WordPress site that has it installed; no other versions are listed as affected.

The CVSS score of 5.4 indicates a medium risk level, and the EPSS score of <1% suggests a low probability of real-world exploitation. The vulnerability is not catalogued in CISA’s KEV list. The likely attack vector is web traffic directed at the plugin’s endpoints, requiring the victim to be logged in, which means targeted or phishing attacks can trigger the exploit. Because exploitation requires an authenticated session, the impact is limited to the privileges of the target account, but could still lead to significant data tampering or defacement.