The vulnerability permits an attacker to forge requests on behalf of an authenticated user, potentially executing privileged actions within WordPress. This form of CSRF can lead to unauthorized content manipulation or configuration changes, depending on the permissions granted to the victim's account. The weakness is identified as CWE-352.

The problem affects the Kuppuraj Advanced All in One Admin Search by WP Spotlight plugin, versions up to and including 1.1.1. Any WordPress installation that has this plugin installed and enabled is at risk.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of current exploitation. The vulnerability is not included in the CISA KEV catalog. The likely attack path requires a victim who is authenticated as an administrator or other privileged user. The attacker would need to trick the victim into visiting a crafted URL or submit a form that triggers the plugin’s functionality.