The Enter Addons plugin has a CSRF vulnerability that allows an attacker to forge requests on behalf of an authenticated WordPress administrator. An attacker can craft a malicious webpage that submits a form or HTTP request to the plugin's unprotected endpoints, causing the admin’s browser to perform actions such as modifying plugin settings or content. The weakness is a classic token‑less CSRF (CWE‑352), which can undermine confidentiality and integrity by enabling unauthorized changes. The impact is limited to functions exposed by the plugin but can matter if those modify site content or configuration.

The flaw affects the Enter Addons plugin version 2.3.2 and earlier. Watermark is for WordPress sites running the 'Enter Addons' add‑on from themelooks. No specific WordPress core or other plugins are listed as vulnerable.

The CVSS score is 4.3, indicating a moderate risk level. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the flaw requires an authenticated user session, the likely attack vector is a malicious site tricking an admin into visiting it while logged in. An attacker needs only a simple crafted request to exploit this issue – no advanced privileges or system access are required. While the chance of exploitation remains low, the potential for loss of control over site settings warrants attention.