The CVE identifies a Cross‑Site Request Forgery (CSRF) vulnerability in the WordPress Easy Table of Contents plugin from Publisher Magazine3. The flaw allows an attacker to send requests on behalf of an authenticated user that the plugin accepts without additional validation. This weakness is classified under CWE‑352. The official description does not specify which plugin functions could be abused, only that arbitrary requests are possible.

The affected product is the Magazine3 Easy Table of Contents plugin for WordPress. All releases from the earliest available version (designated as n/a) through and including version 2.0.80 are vulnerable. No versions beyond 2.0.80 are listed as affected.

The CVSS score of 4.3 indicates moderate severity. EPSS is under 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting it has not been widely leveraged in the wild. Based on the description, the likely attack vector is web‑based; an attacker would need to target a user who is authenticated to the site and craft a malicious request that the plugin processes as if it came from the authenticated user. No specific exploitation conditions beyond the need for an authenticated session are provided, so the risk is assessed as moderate with a low likelihood of exploitation.