The Button Block plugin contains a CSRF flaw that allows an attacker to trigger privileged actions on a WordPress site from a third‑party page. By sending a crafted request that the victim’s browser automatically executes, an attacker can create, edit, or delete button blocks without the user’s consent, resulting in unauthorized content changes or compromise of site integrity. The weakness is identified as CWE‑352.

All releases of the bPlugins Button Block plugin up to and including version 1.2.0 are affected. WordPress installations using any of these versions are at risk. No other WordPress core or plugin versions are impacted.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web request issued from an attacker‑controlled page that a logged‑in user visits. This exploit requires the victim to possess permission to edit buttons within the plugin; the lack of CSRF protection means the request can be sent automatically without additional user interaction.