The vulnerability is a CSRF flaw in the OTWthemes Sidebar Manager Light plugin. An attacker can trick an authenticated user into sending a forged request that causes the plugin to perform unintended actions, such as modifying sidebar content or deleting content. This flaw allows an attacker to abuse the user’s privileges without their knowledge, potentially compromising the confidentiality, integrity, or availability of the site. The weakness corresponds to CWE‑352.

This issue affects the OTWthemes Sidebar Manager Light WordPress plugin, with versions from the initial release through 1.18. Users running any of those releases are vulnerable if the plugin remains activated. No additional vendor products or versions are listed in the current data.

The CVSS score of 4.3 places the vulnerability in the low‑impact range, and an EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to lure a logged‑in user to interact with a malicious site or data feed, making the risk contingent on user behavior and site exposure. Because exploitation requires a victim’s authenticated session, the threat is softer than high‑risk remote code execution but still warrants remediation.