The plugin contains a Cross‑Site Request Forgery flaw (CWE‑352) that allows an attacker to force a logged‑in user to execute actions that the user did not intend. The flaw can lead to unauthorized changes to the plugin’s settings or content, compromising the integrity of the site’s data. The vulnerability is specific to the plugin’s handling of state‑changing requests without proper CSRF validation.

WordPress sites that have installed the LIJE Show Pages List plugin version 1.2.0 or earlier are affected. The issue is limited to the plugin and does not impact other WordPress components directly.

The CVSS score of 4.3 indicates moderate risk, and the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to trick a legitimately authenticated user into opening a crafted request, implying the attack vector is web‑based and relies on user interaction.