The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to trigger the plugin’s disabling action without user interaction. An authenticated user who visits a malicious page could be coerced into submitting a request that disables plugins, affecting site functionality and potentially exposing the site to further attacks. The weakness is classified as CWE‑352, a CSRF weakness that undermines integrity of privileged actions.

The affected product is Meks Quick Plugin Disabler, version 1.0 or earlier, deployed on WordPress installations.

Based on the description, it is inferred that attackers would need to entice an authenticated user into interacting with a crafted request, typically via a link or embedded content, to exploit the weakness. The CVSS score of 5.4 places the issue in a medium severity range, while the EPSS score of less than 1% indicates a low likelihood of being targeted at this time. The vulnerability is not listed in CISA’s KEV catalog. No additional prerequisites are noted beyond user authentication.