The vulnerability is a cross‑site request forgery flaw (CWE‑352) in the DeluxeThemes Userpro WordPress plugin. It permits an attacker to trick an authenticated visitor into submitting forged requests that bypass the plugin’s CSRF checks, potentially enabling unauthorized actions on the site. The CVE text does not enumerate the specific operations that could be performed; the inference that any action facilitated by the plugin might be vulnerable comes from the nature of CSRF attacks.

The flaw affects every installation of the Userpro plugin for WordPress with a version older than 5.1.11, regardless of the underlying WordPress core or server configuration.

The CVSS score of 4.3 indicates moderate impact. The EPSS score of less than 1% points to a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the victim to be logged into the site and an attacker to embed a malicious request—usually via a hosted resource that triggers the action. While CSRF techniques are common, current data suggests that widespread attacks against this weakness are unlikely, though the potential for targeted or opportunistic exploitation remains.