The vulnerability is a classic Cross‑Site Request Forgery flaw, identified as CWE‑352, that allows an attacker to forge authenticated requests on behalf of a logged‑in user. This can lead to the execution of unintended actions within the WordPress site, such as modifying settings, uploading malicious files, or any other action the authenticated user is permitted to perform, potentially compromising site integrity and confidentiality.

Any WordPress installation using the Backup Bolt plugin with a version from the earliest release up to and including 1.5.0 is vulnerable. Upgrading beyond 1.5.0 removes the issue.

The CVSS score of 4.3 classifies the risk as medium. Because the EPSS score is reported as less than 1 %, the likelihood of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The most plausible attack path involves a malicious link or form that an authenticated user visits or submits. While the attack vector is inferred from the nature of CSRF, the official description does not detail an alternative exploitation method.