The AP Background plugin for WordPress contains a CSRF flaw in the advParallaxBackAdminSaveSlider function due to missing or incorrect nonce validation. An attacker who tricks a logged‑in administrator into clicking a crafted URL can create or modify background sliders without authentication. The adversary can alter the appearance of the site by adding or changing background sliders.

WordPress sites using the hovanesvn AP Background plugin version 3.8.2 or earlier. The specific vendor is hovanesvn and the affected product is the AP Background plugin for WordPress. No other versions are listed as vulnerable.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. If the site admin is not protected by additional authentication mechanisms, the attack vector is a forged HTTP request; an attacker can trick an administrator into performing the request. However, the need to target a logged‑in administrator limits the attack scope to the site’s admin users.