The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to trick an authenticated WordPress user into performing actions configured by the WP Email Capture plugin. Because the plugin does not validate request authenticity, a crafted URL or form can change settings or submit email captures without the user’s consent, potentially leading to data leakage or unauthorized configuration changes. The weakness is classified as CWE‑352.

The flaw affects the WP Email Capture plugin created by Rhys Wynne. Versions from the earliest available up to and including 3.12.5 are impacted. WordPress sites that have this plugin installed and are running a vulnerable version are at risk.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1 % indicates that exploitation is considered unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely through a web browser, where an attacker hosts a malicious page that automatically submits a request to the site while a logged‑in user visits the page. Successful exploitation requires that the target user be authenticated and that the plugin’s admin or capture endpoints be reachable.