Cross‑Site Request Forgery in the BP Disable Activation Reloaded plugin allows an attacker to perform privileged operations that should be restricted by access control lists. By forging a request in the context of an authenticated WordPress user, the attacker can invoke the plugin’s functionality—such as disabling or enabling certain features—without possessing the proper permissions. The vulnerability is classified as CWE‑352 and enables unauthorized modification of site behaviors.

The plugin is distributed by Damian under the name BP Disable Activation Reloaded. Versions from the earliest available through 1.2.1 are affected, meaning all releases up to and including 1.2.1 are vulnerable. No specific WordPress core version requirement is listed.

The CVSS score is 6.5, indicating moderate risk. The EPSS score is below 1 %, suggesting that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to persuade a logged‑in user to visit a crafted URL or submit a forged form, leveraging the lack of proper ACL checks within the plugin. If successful, the attacker could elevate privileges or alter site configuration without authorization.