Cross‑Site Request Forgery (CSRF) in the CreativeMindsSolutions CM Ad Changer plugin allows an attacker to forge a request on behalf of a logged‑in user by exploiting the lack of proper request validation. The flaw enables the unauthorized execution of any state‑changing action that the plugin provides, potentially compromising the integrity of the site’s configuration. This weakness is identified as CWE‑352.

WordPress sites that use CM Ad Changer version 2.0.5 or earlier are affected. The plugin runs within any WordPress installation, and users or administrators with sufficient privileges on the site are at risk. No specific operating system or PHP version constraints are noted; the exposure applies broadly to any WordPress deployment with the vulnerable plugin.

The CVSS score of 4.3 denotes a moderate impact, while the EPSS score of less than 1 % indicates that exploitation is unlikely at present. The flaw is not listed in CISA’s KEV catalog, further suggesting limited public exploitation. Based on the description, the attack vector requires an authenticated user to be tricked into visiting a malicious payload, so the likelihood is constrained to environments where administrators or privileged users have network access to the site. Administrators should treat the issue as moderate risk but proactive patching is recommended.