The vulnerability is a Cross‑Site Request Forgery flaw in the impleCode Product Catalog Simple plugin, allowing an attacker to trick an authenticated WordPress user into performing unwanted actions such as creating, updating or deleting product posts without authorization. The weakness is classified as CWE‑352 and can cause unintended state changes, compromising the integrity of the site content.

The affected product is impleCode Product Catalog Simple, version 1.8.4 and all versions prior to it. No other vendors or products are listed as impacted by this CVE.

The CVSS score of 4.3 suggests a medium severity. The EPSS score of less than 1 % indicates very low likelihood of exploitation at the time of analysis. The vulnerability is not present in the CISA KEV list. Exploitation would typically require an attacker to persuade a logged‑in user to visit a crafted URL or submit a malicious form, so passive client‑side attacks are feasible but the likelihood remains low.