The vendor identified a Cross‑Site Request Forgery flaw in the Atelier Create CV WordPress plugin that allows an attacker to change plugin settings when a legitimate user is authenticated. This leads to unauthorized configuration changes without the user's knowledge and is a direct instance of CWE‑352. The vulnerability is present in all releases up to 1.1.5 and can alter how the plugin behaves on the site.

WordPress sites that have the Atelier Create CV plugin installed from any release up to version 1.1.5. The issue affects the entire installation of the plugin and is not limited to a specific component or role, though the attacker requires that the victim be logged in with a userid that has the capability to edit plugin settings.

The CVSS score of 4.3 indicates a moderate risk. However, the EPSS score is reported as less than 1%, meaning that the probability of exploitation is extremely low at present and the vulnerability is not in CISA's KEV catalog. The likely attack vector is a forged request sent to a logged‑in user, which requires the victim to be authenticated to the site with sufficient privileges. While the flaw can be abused, the lack of an active exploit chain and the low EPSS reduce the urgency compared to high‑severity flaws.