A cross‑site request forgery flaw in the Themeisle Cyrlitera WordPress plugin allows an attacker to force an authenticated user to execute actions on the site without the user’s consent. The weakness, identified as CWE‑352, can lead to unauthorized modifications or deletions performed with the privileges of the victim. It does not grant arbitrary code execution or direct data exfiltration but can be used to alter site content, settings, or mechanical operations that the logged‑in user can perform.

WordPress sites that run the Themeisle Cyrlitera plugin, version 1.3.0 or older.

The CVSS base score of 4.3 indicates moderate severity. An EPSS score of less than 1% suggests low probability of exploitation at this time, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires that the target user is authenticated to the site and that the attacker can trick the user into submitting a crafted request, usually via social engineering or a malicious link.