The vulnerability allows the Credova Financial WordPress plugin to accept state‑changing requests without verifying a CSRF token. An attacker can trick an authenticated user into submitting a request that performs an unintended action within the plugin, such as submitting a form or triggering a financial operation. This weakness, identified as CWE‑352, can affect the integrity of the financial data managed by the plugin.

Credova Financial plugin version 2.5.0 and earlier installed on WordPress websites.

The CVSS score of 4.3 reflects moderate severity, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, implying no large‑scale exploitation has been documented. Based on the description, it is inferred that an attacker could exploit the flaw by inducing an authenticated user to submit a crafted request that the plugin accepts as legitimate, thus achieving unauthorized actions.