The vulnerability is a CSRF flaw in the Auto Prune Posts plugin that permits an attacker to submit requests that the site processes as if they came from an authenticated user. This can lead to unintended deletion or modification of posts, potentially disrupting site content and operations. The weakness is rooted in missing or insufficient protection against unauthorized HTTP POST requests (CWE‑352).

The flaw affects WordPress installations that use the Auto Prune Posts plugin version 3.0.0 and earlier, as developed by ramon fincken. Any site running these versions exposes the vulnerable endpoint.

The CVSS score of 6.5 indicates moderate severity; the EPSS score is below 1 %, suggesting that real‑world exploitation is currently unlikely, and the vulnerability is not listed in CISA's KEV catalog. Nonetheless, attackers could attempt to lure a legitimate user to a malicious page that submits a POST request, exploiting the CSRF weakness. The attack requires that the victim be authenticated or that the site does not enforce proper CSRF checks on the endpoint.