The vulnerability is a CSRF flaw in the Epsiloncool WP Fast Total Search plugin that lets an attacker cause a logged‑in WordPress user to perform unwanted plugin actions without additional privileges. Because the plugin does not validate CSRF tokens for sensitive requests, a malicious site can send a forged request that the site accepts and carries out the change, potentially altering plugin configuration, deleting data, or other state‑changing operations.

All WordPress installations running the WP Fast Total Search plugin version 1.79.270 or earlier are affected. The vendor is Epsiloncool and the plugin name is WP Fast Total Search. No minimum affected version is listed, so every version up to and including 1.79.270 should be considered vulnerable.

The CVSS score of 4.3 indicates moderate severity, but the EPSS score of less than 1% means the likelihood of observed exploitation is low. The vulnerability is not currently listed in the CISA KEV catalog. The attack requires that a victim be authenticated to the target and that the attacker can cause the victim to visit a crafted URL or click a link. This is inferred from the nature of CSRF attacks and the plugin’s lack of protection.