The RealPress plugin for WordPress contains a Cross‑Site Request Forgery flaw that permits a malicious actor to persuade an authenticated visitor to issue privileged requests. By exploiting this vulnerability the attacker could alter site content, update settings, or perform any action that the logged‑in user is permitted to execute, thereby impacting the integrity and potentially the availability of the site.

All installations of the RealPress plugin version 1.1.0 or earlier, distributed by ThimPress, are affected. The flaw resides in the plugin’s handling of state‑changing requests without proper CSRF protection.

The CVSS base score of 5.4 denotes a medium severity weakness. EPSS shows a very low exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to be authenticated to the WordPress site and to click or submit a crafted link or form that submits data to the vulnerable endpoint. While it does not allow remote code execution, an attacker who succeeds can manipulate content or configuration in a way that affects confidentiality, integrity, and availability of the affected site.