The Revision Manager TMC plugin for WordPress is impacted by a Cross‑Site Request Forgery (CWE‑352) flaw. The flaw allows an attacker to cause an authenticated WordPress user to unknowingly send requests that invoke privileged plugin actions, such as creating or altering revision data. Based on the description, it is inferred that an attacker could manipulate or delete revision content, thereby compromising the integrity of the site’s content management. No remote code execution is possible without a separate vulnerability.

Vulnerable systems are those running the themastercut Revision Manager TMC WordPress plugin version 2.8.22 or earlier. These affected releases span all revisions up to and including 2.8.22, with no further version boundary specified.

The CVSS score of 4.3 indicates a moderate severity. The EPSS of < 1% suggests exploitation likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. Based on the CSRF nature of the flaw, it is inferred that the attack vector would involve a malicious link or page that submits a forged request to the plugin over the victim’s authenticated session. Successful exploitation would allow the attacker to perform authorized actions without needing direct access to the administrative interface.