The WordPress WP Email Template plugin contains a CSRF flaw that allows an attacker to send forged requests to the site on a victim’s behalf, potentially modifying email templates or plugin configuration. This vulnerability is identified as CWE‑352 and grants an attacker the ability to perform actions under the authenticated user's context without their consent, compromising the integrity of site settings but not granting remote code execution.

WordPress installations using Steve Truman’s WP Email Template plugin version 2.8.5 and earlier are affected. The plugin was known to be vulnerable from its earliest publicly available releases up to and including 2.8.5.

The moderate CVSS score of 4.3 indicates the weakness is not trivial, but the EPSS score of less than 1 % suggests that exploitation is currently uncommon. As it is not listed in the CISA KEV catalog, no widespread exploitation has been reported. The likely attack vector for a CSRF vulnerability is an authenticated user visiting a crafted URL or embedded resource, which would trigger a state‑changing request to the plugin. The flaw could be exploited by social engineering or malicious website links that target logged‑in WordPress users.