The vulnerability is a CSRF flaw in the Beacon Lead Magnets and Lead Capture plugin. A remote attacker can force an authenticated user to submit requests that the plugin processes, potentially changing settings or submitting content without the user’s consent. The weakness stems from missing or insufficient CSRF protection, as identified by CWE‑352. The impact is confined to actions authorized by the victim’s session and does not directly compromise confidentiality or integrity of data beyond the scope of the plugin’s functions.

Vendors Syed Balkhi – Beacon Lead Magnets and Lead Capture Affected versions All releases from the earliest published version up to and including 1.5.8. No later releases are listed as affected by the CVE statement.

The CVSS base score is 4.3, indicating moderate risk. The EPSS score of <1% suggests that exploitation probability is very low at the time of analysis. The issue is not listed in the CISA KEV catalog, implying it has not been reported as a widely‑exploited vulnerability. The most likely attack vector is a phishing or social‑engineering scenario where a user visits a malicious link that submits a forged request to the plugin while the user remains authenticated. No additional prerequisites beyond an active authenticated session were described in the data.