A CSRF flaw in the UPC/EAN/GTIN Code Generator plugin allows an attacker to cause a logged‑in WordPress user to execute code generation or related actions without the user’s consent. The vulnerability does not directly expose data or compromise the system, but it permits misuse of the user’s permissions to perform unintended operations.

WordPress installations running the UPC/EAN/GTIN Code Generator plugin version 2.0.2 or earlier are affected. No other versions or components are impacted by this issue.

The CVSS score of 4.3 reflects moderate risk severity. The EPSS score of <1% indicates a low probability of exploitation, yet this does not eliminate risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is sending a forged request to the plugin’s endpoint, typically via a crafted URL or embedded link, while a legitimate user is authenticated to the site. Successful exploitation would allow the attacker to perform the plugin’s functions as the victim.