This vulnerability is a missing CSRF protection in the Pardakht Delkhah WordPress plugin, allowing an attacker to forge requests from an authenticated user to perform any state‑changing action. The flaw exemplifies CWE‑352 and could lead to unauthorized transactions or configuration changes, compromising the confidentiality and integrity of the site data.

The plugin is developed by Omid Shamloo under the name Pardakht Delkhah. Versions from unknown up to and including 3.0.0 are affected. Any WordPress site that has this plugin installed before upgrading past 3.0.0 is vulnerable, as the plugin processes user‑initiated requests within the WordPress admin area.

The CVSS v3.1 score is 4.3, indicating a low level of impact. The EPSS score is below 1%, suggesting a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA KEV and no public exploitation has been observed. Attackers would need to lure a privileged user to a crafted URL or embedded request; while the attack surface is limited to authenticated users, the threat warrants prompt mitigation.