This CSRF vulnerability allows an attacker to trigger state‑changing operations performed by authenticated users without needing credentials. The flaw is linked to CWE‑352 and can lead to unauthorized changes or data leakage, depending on the functions exposed by the Web Accessibility with Max Access plugin.

Organisations using the Ability Inc Web Accessibility with Max Access plugin version 2.0.9 or earlier are impacted. The vulnerability applies to all releases listed as "from n/a through <= 2.0.9" in the vendor's product range.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the current time. The plugin is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker delivering a malicious link or form to an authenticated user’s browser, causing the browser to perform an unintended request that the plugin will accept. The vulnerability does not require elevated privileges beyond the user’s session tokens.