This vulnerability is a Cross‑Site Request Forgery (CWE‑352) that allows an attacker to perform unauthorized actions on behalf of an authenticated user by forging requests. The affected Calculated Fields Form plugin permits such requests without sufficient validation, which means a malicious site could trick a logged‑in user into submitting a form that triggers unintended operations. The potential impact is primarily the compromise of user‑level privileges, leading to unauthorized changes within WordPress sites.

The vulnerability affects the Calculated Fields Form plugin developed by CodePeople, already identified as "calculated-fields-form". All releases up to and including version 5.3.58 are susceptible. Users of WordPress sites employing this plugin prior to version 5.3.59 are at risk.

The assigned CVSS score of 4.3 indicates a moderate threat level. The EPSS score of less than 1% suggests a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, but it remains a valid risk for any site still using the affected ranges. Attackers would need network access to the victim’s WordPress site and a browser session with an authenticated user to exploit the CSRF fault, usually by persuading the user to visit a malicious page that submits a forged request to the form endpoint.