The vulnerability is a classic Cross‑Site Request Forgery flaw that allows an attacker to cause an authenticated WordPress user to unknowingly perform state‑changing actions through the DarkMySite plugin. By crafting a malicious page that triggers requests to the plugin’s endpoints, the attacker can alter site appearance or settings without the user’s consent. The weakness is identified as CWE‑352.

The issue impacts the DarkMySite WordPress plugin version 1.2.8 and all earlier releases, distributed by the vendor DarkMySite. WordPress sites that have installed this plugin and are running one of these affected versions are potentially susceptible.

The CVSS score of 4.3 indicates a moderate security impact. The very low EPSS score of less than 1% suggests that real‑world exploitation is unlikely at the time of reporting. The vulnerability is not listed in the CISA KEV catalog and no exploitation platform has been documented. The attack path is typical for CSRF: an unauthenticated malicious web page can cause the authenticated user’s browser to send requests to the plugin endpoints, thereby carrying out the attacker’s intent if the user is logged in and the required cookie or session is present.