This vulnerability, identified as CWE-352, allows an attacker to perform a cross‑site request forgery against the WordPress SALESmanago Plugin. The flaw enables malicious requests to be executed with the privileges of an authenticated user, potentially modifying data or triggering undesired actions without the user’s consent. The reported CVSS score of 4.3 indicates a moderate impact on confidentiality and integrity but does not pose an immediate threat to availability.

The issue affects the SALESmanago and Leadoo versions of the WordPress plugin up to and including 3.8.1. Any WordPress site that has this plugin installed and has not applied a newer version is susceptible to the attack.

Given the EPSS score of less than 1 percent and the absence of this vulnerability from CISA's KEV catalog, the likelihood of real‑world exploitation is low. However, the attack vector is straightforward: an attacker can craft a forged request, such as a malicious link or form submission, that a logged‑in user will unknowingly execute. The lack of CSRF tokens or verification allows the request to be processed by the plugin, granting the attacker the capabilities of the victim. The moderate CVSS rating reflects the potential for data manipulation but does not imply severe consequences.