The vulnerability is a Cross‑Site Request Forgery flaw that allows a malicious site to craft a URL or form which, when visited or submitted by a logged‑in administrator of a WordPress site running WP SEO Search, could cause the site to perform state‑changing actions without the user's consent. This weakness is identified as CWE‑352 and enables an attacker to potentially alter plugin settings or perform other privileged actions on the site, compromising the integrity of the site’s configuration.

The affected product is the WP SEO Search plugin by Angel Costa, versions from the earliest available up to and including 1.1. Any WordPress site using one of these versions is susceptible.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure an authenticated user to a crafted page; the breach requires the victim to be logged in with sufficient privileges to access the plugin’s administrative functions.