A cross‑site request forgery flaw is present in the QuantumCloud Simple Link Directory WordPress plugin. The vulnerability allows an attacker to send forged requests on behalf of an authenticated user, but the CVE description does not specify which operations are affected; it only indicates that unauthorized actions could be performed. The weakness is catalogued as CWE‑352 and primarily threatens data integrity by allowing an attacker to manipulate the link directory’s contents.

All sites that have installed the QuantumCloud Simple Link Directory plugin version 8.8.3 or earlier are vulnerable. The flaw applies to any site running the plugin from the QuantumCloud distribution without the patch released for version 8.8.4 or later.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1 % suggests a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would involve a victim who is authenticated to the site visiting a malicious page that causes a forged request to the WordPress backend. The CVE does not specify whether elevated privileges are required; it only states that unauthorized actions could be performed if the request is accepted.