The vulnerability is a Cross‑Site Request Forgery flaw in the WPKube Authors List plugin up to version 2.0.6.2. It allows an attacker to submit forged requests that the site processes as if they were made by an authenticated user, potentially leading to unauthorized modifications of author data or other plugin functions. The weakness is classified as CWE‑352.

WordPress installations using the WPKube Authors List plugin version 2.0.6.2 or earlier are affected. The plugin integrates into the WordPress admin interface and is typically used to display or manage author lists on a site.

The CVSS score of 4.3 signals a moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The attack vector is web‑based CSRF, requiring the victim to be authenticated to the target site and to follow a crafted link or form. The vulnerability is not listed in the CISA KEV catalog.