The flaw is a Cross‑Site Request Forgery vulnerability in Flashyapp’s WP Flashy Marketing Automation plugin version 2.0.8 and earlier. An attacker can cause a logged‑in WordPress user to send a forged request that alters the plugin’s configuration or initiates actions without the user’s explicit consent. This weakens the integrity of the system and permits unauthorized marketing actions. The weakness is categorized as CWE‑352.

The issue affects any WordPress installation that has the WP Flashy Marketing Automation plugin at version 2.0.8 or older. All releases from the earliest available to 2.0.8 are vulnerable; no specific sub‑versions are listed beyond this cutoff.

CVSS score of 4.3 indicates moderate severity, while the EPSS score is below 1%, implying low expected exploitation probability. The vulnerability is not in CISA’s KEV catalog. The likely exploitation path requires a logged‑in user’s browser to submit a request to the plugin’s endpoint without a CSRF token. If the user holds sufficient privileges, the attacker can manipulate settings or trigger plugin actions, but no additional privileges or network access are needed.