The Ultimate FAQ plugin released by Rustaurius contains a Cross‑Site Request Forgery flaw that permits an attacker to force an authenticated user to perform unintended actions through crafted requests. This can lead to unauthorized changes to FAQ entries, settings, or other protected resources, compromising data integrity and potentially exposing sensitive content. The weakness is identified as CWE‑352.

All WordPress sites that have installed the Ultimate FAQ plugin version 2.4.3 or earlier are vulnerable. Any installation matched with the known product name “Rustaurius Ultimate FAQ” in that version range is affected.

The vulnerability carries a moderate CVSS score of 4.3 and an EPSS score of less than 1 %, indicating a low probability of exploitation at the time of assessment. It is not listed in the CISA KEV catalog. Exploitation would most likely occur through a web‑based attack that takes advantage of the lack of anti‑CSRF tokens, requiring a victim to be logged in and to visit a malicious link or form. Once achieved, the attacker can submit requests that alter or create content within the plugin’s scope.