The flaw exists in the Sigmize plugin for WordPress and allows attackers to trick a logged‑in user into sending a forged request that is processed by the plugin. Because the plugin does not enforce origin checks, a malicious link or form can trigger arbitrary state‑changing operations that the user intended to perform. This vulnerability represents a moderate security risk as it enables unauthorized actions by leveraging an authenticated session.

WordPress sites that have the Brainstorm Force Sigmize plugin installed, version 0.0.9 or earlier, are vulnerable. The issue applies to all users who can authenticate to the site and access the Sigmize plugin interface.

The CVSS score of 4.3 indicates moderate severity. The estimated exploitation probability, as reflected by an EPSS score of less than 1%, suggests a very low likelihood of real‑world exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user to inadvertently visit a crafted URL or submit a forged form; no additional conditions beyond an active session are required according to the CVE description.