The vulnerability permits an attacker to forge requests on behalf of a victim user, causing the plugin to perform unintended actions such as submitting data or modifying settings. This compromise of integrity can lead to unauthorized configuration changes or data exposure, depending on the privileges of the compromised account. The weakness is identified as CWE-352.

The affected product is Oganro Travel Portal Search Widget for HotelBeds APITUDE API by Oganro. All released versions up to and including 1.0 are vulnerable; versions prior to the first release are also affected as indicated by "n/a through <= 1.0".

The CVSS score of 4.3 categorizes the vulnerability as moderate risk, while the EPSS score of less than 1% indicates a very low probability that exploitation will occur in the near term. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits. The likely attack vector is a browser‑based CSRF attack that requires the victim to be authenticated to the WordPress site; the attack can be executed by tricking the user into visiting a malicious page that submits a request to the plugin’s endpoint.