The Simple Page Access Restriction plugin for WordPress contains a Cross‑Site Request Forgery flaw (CWE‑352) that allows an attacker to force a legitimate user’s browser to send a crafted request to the plugin’s endpoint. The CVE description explicitly states this capability, and based on that information it is inferred that an unauthorized action can be performed without the user’s consent, potentially leading to content changes or other privileged operations within the site.

The vulnerability is present in all versions of the Simple Page Access Restriction plugin up to and including 1.0.32, developed by Plugins and Snippets for WordPress.

The CVSS score of 4.3 reflects moderate severity, while the EPSS score of less than 1% indicates a low practical likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector would be a web request from a user’s browser, where an attacker could embed a malicious link or form that triggers the vulnerable endpoint, exploiting the lack of CSRF protection. Remediation is straightforward once the plugin is updated, but until then the risk remains if a user visits forged requests.