Cross‑site request forgery in the Simple Folio plugin is described as a vulnerability that may allow an attacker to trick an authenticated user into submitting requests that perform any administrative actions the user is authorized to do. The flaw does not grant execution of arbitrary code; it likely enables unauthorized modifications to site content, but the CVE does not list specific actions. Based on typical CSRF behavior, the attacker could potentially trigger any administrative action the victim is permitted to execute.

The vulnerability affects the WordPress Simple Folio plugin developed by PressTigers. Any installation of Simple Folio up to and including version 1.1.0 is affected. Newer releases beyond 1.1.0 are not impacted.

The CVSS score of 4.3 indicates medium severity. The EPSS score of less than 1 % suggests exploitation is unlikely in the near term, and the issue is not listed in CISA KEV. Because the vulnerability is a CSRF flaw, an attacker may attempt to trick an authenticated user into visiting a crafted URL or clicking a malicious link. The specific user privileges required for impact are not explicitly detailed in the CVE, but the potential damage would depend on the victim’s role.