A cross‑site request forgery flaw exists in WP Front User Submit / Front Editor, versions up to 5.0.6, where missing CSRF tokens allow an attacker to submit a forged request that the plugin processes as originating from the victim. The vulnerability can lead to integrity violations, such as posting, editing, or otherwise manipulating content, depending on the victim’s privileges. Based on the description, it is inferred that any legitimate action that the authenticated user is permitted to perform could be abused when CSRF protection is absent.

The flaw affects the WordPress plugin WP Front User Submit / Front Editor developed by aharonyan, specifically installations running version 5.0.6 or earlier. Users of these versions on their WordPress sites are therefore exposed to this vulnerability.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The issue is not listed in CISA KEV, implying no widespread exploitation has been reported. The likely attack vector is a web‑based CSRF: an adversary can embed a malicious link or form in a third‑party site that, when visited by an authenticated user, will cause the user’s browser to submit a forged request to the vulnerable plugin. Exploitation requires the victim to be logged in and to possess privileges that allow the targeted action, but the impact remains significant if successful.