The Robots.txt rewrite plugin for WordPress suffers from a CSRF flaw that permits an attacker to submit unauthorized requests using an authenticated user’s session. This flaw can be leveraged to alter the robots.txt contents or other protected settings, thereby compromising web crawling behavior and potentially exposing sensitive URLs. The weakness is classified as CWE‑352.

WordPress sites that install the Robots.txt rewrite plugin version 1.6.1 or earlier, supplied by Eugen Bobrowski.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would likely require an authenticated administrator session or a user with the ability to trigger the affected request path, making the assault dependent on insider or compromised credentials.