The vulnerability exists in the Ays Pro Quiz Maker plugin for WordPress and is classified as a Cross‑Site Request Forgery (CWE‑352). It allows an attacker to request actions on the site where a user is authenticated, potentially executing actions without the user’s explicit permission. The CVE description does not specify the exact operations that could be performed, so the impact is limited to the fact that any action that the authenticated user can perform via the plugin may be forced by an external request.

WordPress installations using the Ays Pro Quiz Maker plugin version 6.7.1.2 or earlier are affected. This includes every site that has not upgraded past that version.

The CVSS score of 4.3 indicates a moderate potential impact, while the EPSS score of less than 1% suggests a currently low likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Since CSRF attacks are generally performed from an external web page that the victim visits, the attack vector is inferred to be remote and web‑based.