The vulnerability is a CSRF flaw that permits an attacker to force a victim's browser to execute actions that normally require authentication, effectively bypassing the login mechanism. The flaw is categorized as CWE-352 and can compromise the integrity and availability of the WordPress site by allowing unauthorized operations once the forgery is successful.

The Javo Core plugin for WordPress, sold by javothemes, is affected in all releases through version 3.0.0.266. No further version details are listed in the CNA data. Sites using any of these vulnerable releases are at risk.

The CVSS score of 8.8 quantifies a high severity risk, while the EPSS score of less than 1 % indicates that, at present, active exploitation of this flaw is uncommon but still possible. Based on the description, it is inferred that the attacker must trigger a forged request from the victim’s browser; therefore the attacker requires either user interaction or another vulnerability that can coerce the browser into submitting the request. As the vulnerability is not listed in the CISA KEV catalog, it is not currently flagged as a known exploited vulnerability, but the potential impact remains significant for sites running the affected plugin.