This vulnerability permits a cross‑site request forgery (CSRF) attack in the axew3 WP w3all phpBB integration plugin, allowing an attacker to cause a victim’s browser to submit a crafted request on behalf of the victim while the victim is authenticated. The exploit can result in unauthorized actions, such as data manipulation or other changes that typically require the victim’s privileges. The weakness is specifically a missing CSRF token for protected operations, making it a classic input‑validation flaw described by CWE‑352.

The affected vendor and product are axew3's WP w3all phpBB integration plugin. Versions from the initial release through 2.9.8 are impacted. No specific sub‑version detail is supplied beyond this upper bound.

The CVSS score of 4.3 indicates a medium severity level. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated user to be tricked into visiting a malicious site, where a forged request would be sent using the victim’s credentials. While the risk is moderate, the absence of a CSRF token makes the vulnerability easier to exploit if the conditions are met.