The vulnerability allows an attacker to perform a cross‑site request forgery that results in the unauthorized import of tags. Because the plugin fails to validate the required nonces, an attacker only needs to entice a site administrator to click a crafted link. This can lead to the injection of unwanted tags and the alteration of taxonomy structure, potentially disrupting site navigation and content organization, although it does not grant direct code execution or database compromise.

All installations of the Ultimate Tag Warrior Importer plugin version 0.2 or earlier on WordPress sites are affected.

The CVSS score of 4.3 classifies the issue as low severity, and the EPSS score of <1% indicates a very low likelihood of active exploitation. The flaw is not listed in the CISA KEV catalog. The exploitation requires persuading an authenticated administrator to perform an action, such as clicking a malicious link, which is a simple and typical CSRF attack vector.