The Cool Author Box plugin for WordPress version 3.0.0 and earlier is vulnerable to cross‑site request forgery. An attacker can force a logged‑in administrator or other privileged user to submit a request that the plugin interprets as a legitimate action, potentially altering plugin settings or site content. This flaw enables unauthorized state changes that could compromise site integrity or allow an attacker to maintain persistence through altered configurations.

The vulnerability affects the Hossni Mubarak Cool Author Box plugin for WordPress with all versions from the initial release up to and including 3.0.0.

The overall CVSS score of 4.3 indicates moderate risk. The EPSS score of less than 1% suggests that active exploitation is currently rare, and the vulnerability is not catalogued in the CISA KEV list. The likely attack path requires a user with authenticated privileges to be tricked into visiting a malicious site, so the vector is web‑based CSRF. While the exploitation probability is low, the potential impact on administrative controls warrants timely remediation.