Based on the description, it is inferred that a Cross‑Site Request Forgery flaw exists in the WordPress Bulk Term Editor plugin that allows an attacker to submit forged requests that are processed with the privileges of a logged‑in user. This can enable the attacker to modify, add, or delete taxonomy terms without the user’s direct interaction with the plugin’s interface, potentially disrupting site organization or content categorization.

The vulnerability affects the Bulk Term Editor plugin developed by Yuya Hoshino, version 1.1.4 and all earlier releases. No other WordPress plugins or core components are impacted.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers can exploit the flaw by creating a malicious link or form that a logged‑in user inadvertently submits, triggering unintended changes in the taxonomy data.