The vulnerability allows an attacker to forge a request that performs privileged actions on behalf of an authenticated WordPress user. It is a classic CSRF flaw, identified as CWE‑352, and can be used to alter or delete content, change settings, or perform other actions that the authenticated user is permitted to do without the user’s explicit consent.

WordPress installations that have the Post Type Converter plugin version 0.6 or earlier installed, as distributed by Kevin Langley Jr.; all newer versions are not affected.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% means exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog. An attacker would need to lure an authenticated user to a crafted URL or submit a forged form, which implies the attack vector is a web request that includes the user’s session credentials. No additional prerequisites are stated, so the risk is limited to environments where the plugin is active and users frequently interact with the site.