The CM Answers plugin for WordPress contains a Cross‑Site Request Forgery flaw that allows an attacker to trick a logged‑in user into performing unintended actions without their knowledge. This weakness arises from missing or ineffective CSRF protection when handling state‑changing requests, and it correlates with CWE-352. While the CVSS score of 4.3 indicates a moderate severity, the flaw can compromise the integrity of data or the functionality of the website by exploiting authenticated users' sessions.

All installations of CreativeMindsSolutions CM Answers for WordPress from the earliest release up to and including version 3.3.3 are vulnerable. Administrators should verify the plugin version and upgrade if necessary.

With an EPSS score below 1 % the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is inferred to be user‑interaction based: an attacker hosts a malicious page that submits a forged request to the target site, relying on the victim's authenticated session cookies. Successful exploitation would allow unauthorized changes to content, configuration, or access rights, depending on the sensitive actions protected by the plugin.