The CVE describes a Cross‑Site Request Forgery flaw in the Tusko Trush Advanced Custom Fields : CPT Options Pages plugin that enables an attacker to inject arbitrary objects into the WordPress backend. The injected objects could alter plugin configuration or data structures, potentially compromising data integrity or permitting unintended actions, but the description does not confirm remote code execution or broader system compromise.

All installations of the Advanced Custom Fields : CPT Options Pages plugin released by Tusko Trush with version numbers up to and including 2.0.9 are vulnerable. Any WordPress site running a susceptible version is at risk.

The CVSS score of 8.8 classifies the issue as high severity, yet the EPSS score of less than 1% indicates a presently low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the CSRF nature of the flaw, the likely attack vector is a web‑based request that requires a logged‑in WordPress user to be tricked into submitting a malicious form or link targeting the plugin’s options pages.