A CSRF flaw exists in the Hide Admin Bar From Front End plugin that lets an attacker cause logged‑in users to trigger unintended actions. By submitting a forged request, the attacker can manipulate the display of the admin bar, and potentially gain access to administrative interfaces or modify content. This weakness maps to CWE-352, showing the plugin fails to verify the request origin.

The issue affects Aftab Husain’s Hide Admin Bar From Front End plugin, versions 1.0.0 and all earlier releases, when installed on WordPress sites. No specific WordPress core versions are cited, so any WordPress installation using the vulnerable plugin is impacted.

The CVSS score of 4.3 indicates medium severity, but the EPSS value of less than 1% signals a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attacks would rely on a remote attacker tricking a logged‑in user into submitting a crafted request; credentials are not required, but the victim must be authenticated and have rights to view or alter the admin bar. The likely attack vector is social engineering or phishing, and exploitability depends on user awareness and security awareness practices.