The reported flaw is a Cross‑Site Request Forgery (CSRF) condition in the occupancyplan WordPress plugin. This defect permits an attacker to construct a request that will be accepted by the application on behalf of a logged‑in user and trigger arbitrary SQL statements, potentially allowing data disclosure, modification or deletion. The CVSS score of 8.2 places the weakness in the high severity range, indicating significant risk if exploited.

All installations of the occupancyplan plugin distributed by vendor x000x, from the earliest revision through version 1.0.3.0, are vulnerable. No other products or earlier revisions are listed as affected in the available data.

The EPSS score is below 1 %, implying that widespread exploitation is currently unlikely, and the vulnerability has not been recorded by CISA in its KEV catalogue. The likely attack vector involves an attacker embedding a malicious URL in an email or on a website, tricking a logged‑in administrator into clicking it, and causing the plugin to execute harmful SQL. Because the weakness requires a victim who has the appropriate privileges, the scope is limited to systems where the plugin is enabled and users assign administrative rights. Vendors should treat the flaw as high risk until a patch is installed.