Cross‑Site Request Forgery submitted through the Off‑Canvas Sidebars & Menus (Slidebars) plugin allows an attacker to forge authenticated requests against a target site. The weakness is a missing anti‑CSRF token requirement in plugin endpoints, categorized as CWE‑352. Successful exploitation could enable the attacker to perform actions that the authenticated user is authorized to do, such as adding or removing sidebars, thereby affecting site configuration and integrity.

The affected vendor is Jory Hogeveen, whose WordPress plugin Off‑Canvas Sidebars & Menus (Slidebars) is vulnerable when installed at versions 0.5.8.5 or earlier. No other vendors or products are currently identified as affected.

The CVSS score is 4.3, indicating moderate severity, while the EPSS score is below 1 %, suggesting low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The apparent attack vector is CSRF, meaning an attacker can trigger the vulnerable action by getting an authenticated user to visit a malicious site or link, inducing a cross‑site request that the plugin accepts without verification.