The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw in the WordPress Media Library Downloader plugin version 1.4.0 and earlier. It allows attackers to trick a logged‑in user into triggering unauthorized actions against the site’s media library. The flaw originates from the absence of a CSRF token or proper verification, enabling an attacker to force the victim to perform actions without consent.

All WordPress sites running the Media Library Downloader plugin, known as M.Code, with version 1.4.0 or earlier are affected.

Based on the description, it is inferred that an attacker must first convince a logged‑in user to visit a malicious page that submits a request to the plugin’s endpoint. The exploit requires user interaction, which gives it a low probability of success, as reflected by an EPSS score of less than 1%. The CVSS score of 4.3 indicates moderate severity with potential confidentiality and integrity impact. The vulnerability is not listed in the CISA KEV catalog, implying no widespread exploitation has been documented at this time.