Simple Giveaways is affected by a CSRF flaw that lets a malicious web page create forged requests to the plugin’s administrative endpoints. An attacker can trigger actions that the visitor performed without their consent, potentially altering giveaway settings or permissions. The weakness hinges on insufficient origin validation (CWE‑352).

WordPress sites running Igor Benic’s Simple Giveaways plugin versions up to and including 2.49.0 are vulnerable. No other vendors or products are listed.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending a forged POST request from a malicious site; no authentication or elevated privileges are required beyond those of the targeted user. Once triggered, the impact is limited to the affected plugin’s configuration and does not expose the operating system or database directly.