The vulnerability resides in the Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin for WordPress. An unauthenticated attacker can cause the vulnerable BDFE endpoint to install the third‑party 'rs-wp-books-showcase' plugin by sending a forged request that bypasses nonce validation. The result is that the plugin is added to the site without the administrator’s knowledge, potentially exposing the site to malicious code from the newly installed plugin.

WordPress sites using the mdimran41 Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid plugin 1.1.7 or earlier are affected. Site administrators must review the installed plugins and ensure that this plugin version is not in use; if it is, they should update or remove it.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a crafted link presented to a site administrator that, when clicked, submits a CSRF request to the vulnerable endpoint; no authentication is required for the attacker, but social engineering is necessary to get an admin to trigger it.