The vulnerability is a Cross‑Site Request Forgery that allows an attacker to cause a legitimate user’s browser to submit requests to the WordPress Ebook Store plugin without the user’s consent. An uncontrolled request can trigger state‑changing actions such as modifying product listings or executing administrative functions. The weakness is identified as CWE‑352, which directly relates to the absence of proper request validation.

The flaw affects the Ebook Store plugin for WordPress distributed by motov.net, specifically versions from the earliest available through 5.8013. Any WordPress installation that has an affected version of this plugin deployed is at risk unless the plugin has been replaced or upgraded.

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The plugin is not listed in the CISA KEV catalog. The most probable attack path involves a malicious site linking to a crafted URL that triggers the vulnerable action while the victim’s browser is authenticated to the WordPress site. This inferred vector relies on the victim’s existing session and the absence of anti‑CSRF checks in the plugin.