The flaw is a classic Cross‑Site Request Forgery in the KCS Responder WordPress plugin. It lacks proper anti‑CSRF protection, allowing an attacker to craft a request that a logged‑in user will send without realizing. The impact is that authenticated users may unwittingly perform state‑changing actions that the attacker specifies, thereby compromising the integrity of the site.

This vulnerability affects the KCS Responder WordPress plugin, any installation running version 4.3.8 or earlier. No specific sub‑versions beyond 4.3.8 are listed, so all earlier releases are impacted.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests low probability of being exploited today, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based request sent to the victim’s browser; the attacker must convince the authenticated user to visit a specially crafted link or load malicious content. The absence of CSRF tokens or referrer checks makes the exploitation straightforward for anyone who can lure a logged‑in user.