Cross‑Site Request Forgery (CSRF) vulnerability exists in the WordPress Kama Thumbnail plugin, which allows an attacker to force a victim’s browser to send unauthorized requests to the site. This flaw is classified as CWE‑352 and can enable the attacker to carry out unwanted actions such as modifying, deleting, or creating content if the victim is logged in with sufficient privileges. The vulnerability does not grant direct remote code execution or disclosure of sensitive data on its own, but it can be leveraged to compromise the consistency and integrity of the site’s content and settings.

The flaw affects the Kama Thumbnail plugin from all versions prior to 3.5.2, i.e., any installation of Kama Thumbnail version 3.5.1 or earlier. The plugin is maintained by Timur Kamaev and is commonly used within WordPress sites.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that attackers would need to trick a logged‑in user (typically an administrator) into visiting a crafted URL or submitting a forged form, thereby exploiting the lack of CSRF tokens on the plugin’s state‑changing endpoints.