The vulnerability is a CSRF flaw that allows forged HTTP requests to interact with the Popularis Extra plugin, potentially leading to unauthorized changes to plugin settings or other data when a user is authenticated. Based on the nature of CSRF, it is inferred that an attacker might alter site statistics or configuration data by exploiting the plugin’s lack of request origin verification.

The Themes4WP Popularis Extra plugin for WordPress is affected, with all releases up to and including version 1.2.10 at risk. WordPress sites that have installed any of these versions are listed as impacted.

The CVSS score of 5.4 indicates a moderate risk level, while the EPSS score of less than 1% suggests a currently low likelihood of exploitation. The vulnerability is not included in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to target a user who is logged in with sufficient privileges to access Popularis Extra, then craft a malicious link or form that submits data to the plugin’s endpoints. Because this is a CSRF issue, no additional privileges beyond those of the authenticated user are required for exploitation.