The WP Blast | SEO & Performance Booster plugin contains a CSRF flaw in its Settings functions caused by missing or incorrect nonce validation. An attacker who can lure an administrator into clicking a crafted link can cause the site to purge its cache, clear the sitemap, delete plugin data, or reset SEO scoring. The flaw does not provide direct data theft or system compromise, but it disrupts administrative functions that affect site performance and search‑engine visibility.

All WordPress installations that have the WP Blast | SEO & Performance Booster plugin version 1.8.6 or earlier are affected. No higher versions are listed as vulnerable in the CVE record.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to successfully perform a CSRF attack, which typically relies on social engineering to trick an administrator into submitting a forged request. While the impact is limited to non‑critical administrative actions, it can still disturb site operation and user experience.