The Vulnerability allows a malicious actor to forge a request from a victim who is authenticated to the WordPress site. The attacker can force the victim’s browser to perform actions that the website otherwise would permit, potentially altering data or executing privileged operations. This weakness maps to CWEs that involve improper validation of request integrity, such as CWE‑352, and can lead to unauthorized information disclosure or manipulation of site data when an authenticated user visits a crafted URL or clicks a link.

The Metagauss RegistrationMagic plugin, all versions from the initial release up to and including 6.0.6.9, is affected. Users running any of these versions on their WordPress installations are susceptible if the plugin is enabled and an attacker can deliver a forged request to a logged‑in user.

The CVSS v3 base score of 5.4 indicates moderate severity, and an EPSS score of less than 1% reflects a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known mass exploitation. However, the attack vector requires a victim to be authenticated and to click a malicious link, so the threat primarily concerns sites that expose exposed registration or administrative interfaces to public or moderately trusted users.