A cross‑site request forgery flaw enables an attacker to trick an authenticated WordPress user into submitting a request that the plugin processes, potentially changing user settings or data without the user’s consent. This flaw is a type‑352 weakness and does not provide direct code execution, but it allows the attacker to perform actions that the authenticated user is authorized to do.

WordPress installations using the Quick Interest Slider plugin version 3.1.5 or earlier are vulnerable. The issue affects all configurations of the plugin available from the vendor Graham through the specified version threshold.

The CVSS score of 4.3 classifies the vulnerability as moderate in base severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Likely attack vectors involve social engineering or malicious links that cause the victim to visit a crafted URL while logged into the site, leveraging the lack of proper nonce verification.