Cross‑Site Request Forgery (CSRF) is present in the Merge + Minify + Refresh WordPress plugin because it does not validate the authenticity of state‑changing requests. This flaw can allow an attacker to cause a logged‑in user to perform privileged actions without the user’s consent. Based on the description, it is inferred that the plugin may permit modification of site settings or content when accessed via administrative endpoints without a CSRF token.

Any WordPress installation that includes launchinteractive’s Merge + Minify + Refresh plugin version 2.14 or earlier is affected. The vulnerability applies to all deployments that have not upgraded beyond that release.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Because it is a CSRF weakness, an attacker would need to entice an authenticated user—typically an administrator—to visit a malicious site that triggers the plugin’s vulnerable endpoints. Based on the description, it is inferred that controlling the end‑user’s interaction with the site is required for exploitation.