The vulnerability resides in the AHAthat Plugin for WordPress and results from a missing or incorrect nonce validation in the aha_plugin_page() function. This classic CSRF flaw allows an attacker who tricks an administrator into visiting a crafted link to remove AHA pages without authentication, causing loss of content and potential disruption of site functionality. The weakness is identified as CWE‑352, reflecting the lack of proper request validation.

Versions of the AHAthat Plugin up to and including 1.6, distributed by vendor mitchelllevy, are affected. The flaw exists in the core admin interface of the plugin and has no additional version restrictions beyond the 1.6 cutoff.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a social‑engineering step that convinces a site administrator to click a malicious link, after which the unauthenticated attacker can delete pages via the forged request.