The vulnerability is a CSRF flaw in the bulk_action_handler function of the PhpList Subber plugin for WordPress. Missing or incorrect nonce verification enables an attacker who can lure a site administrator to click a crafted link or URL to initiate a bulk sync of subscription forms. The action is performed as the impersonated admin, potentially affecting the integrity of the form data but not the confidentiality of the site. The flaw is classified as CWE‑352.

WordPress sites running the PhpList Subber plugin version 1.1 or earlier, supplied by the vendor vinzzb. Any installation of this plugin that exposes the bulk sync admin endpoint is vulnerable.

The CVSS score of 4.3 places the vulnerability in a medium‑risk range. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. Exploitation requires an unauthenticated attacker to deliver a forged HTTP request and convince an administrator to perform the action, so the attack vector is social engineering and web‑based. If the attacker succeeds, the affected administrator would execute a bulk sync operation with the site’s credentials.