Aioseo Multibyte Descriptions, a WordPress plugin, contains a Cross‑Site Request Forgery vulnerability that allows an attacker to send a forged request that is processed with the privileges of a logged‑in user. This flaw can be leveraged to perform state‑changing operations on the WordPress site without the user’s consent, potentially modifying content, settings, or other data. The weakness is classified as CWE‑352.

WordPress installations running the Aioseo Multibyte Descriptions plugin version 0.0.6 or earlier, developed by rui_mashita. The vulnerability applies to all affected releases indiscriminately, regardless of site configuration.

The CVSS score of 4.3 indicates moderate severity, but the EPSS score of less than 1% and absence from the CISA KEV catalog suggest a low likelihood of exploitation in the wild. The attack vector is inferred to be a web‑based POST or GET request that the user’s browser would execute, requiring the victim to be authenticated. An attacker can achieve this by embedding a malicious link or form on a compromised webpage, social engineering a logged‑in user, or exploiting sites that allow public post requests.