Tailored Tools, a WordPress plugin from Tailored Media, contains a flaw that allows a cross‑site request forgery (CWE‑352) vulnerability. The bug lets an attacker build a forged request that the plugin accepts as coming from a legitimate, authenticated user, thereby carrying out privileged actions without the user’s consent. Based on the nature of the vulnerability, it is inferred that the attacker would need to get a victim’s browser to send a forged request to the plugin endpoint, typically through a malicious link or embedded content. While the detailed impact is not spelled out in the description, the flaw can be used to modify data, delete content, or otherwise alter the state of a WordPress site, undermining confidentiality, integrity, and potentially availability if the plugin performs undesired operations.

Tailored Media’s Tailored Tools WordPress plugin is affected. All releases from the initial version through 3.0.3 contain the vulnerability. Administrators should verify the installed plugin version to confirm whether the site runs a version older than 3.0.5 and therefore remains exposed.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so no quantified exploitation probability is reported. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no widely‑known exploit has been documented. Attackers may rely on a victim who is logged into the site or who visits a malicious page that forces a browser to submit a forged request. Because CSRF typically requires the victim’s session credentials, the attack is privileged only when the victim is authenticated. A successful exploit thus threatens the confidentiality and integrity of the site’s content and could also affect availability if the plugin is forced to perform resource‑intensive operations.