The vulnerability is a CSRF flaw that allows an attacker to force a logged‑in user of a WordPress site to perform actions through the Semrush Content Toolkit plugin. Although the specific privileged actions that can be triggered are not enumerated, CSRF generally enables an attacker to change settings, submit content, or otherwise alter site state under the credentials of the victim. The weakness is identified as CWE‑352.

Semrush Content Toolkit plugin for WordPress, versions from the initial release through 1.1.32 are affected. Any WordPress installation using one of these plugin versions is at risk.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1 % reflects a low probability of attack at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring a victim user to visit a malicious page that sends a forged request to the site with the plugin active. An attacker needs the victim to be authenticated and have sufficient privileges for the action that the plugin performs.