The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to trick an authenticated user into performing unintended actions. By exploiting this flaw, a malicious actor could force a logged‑in administrator to make changes that the attacker wishes, potentially modifying site content, settings, or even injecting malicious code. The weakness is identified as CWE‑352.

The flaw affects the RT‑Theme 18 | Extensions plugin from any version up to and including 2.5. Users of WordPress sites that have this plugin installed and enabled are potentially exposed.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is below 1%, suggesting that exploitation is currently unlikely but possible. The vulnerability is not listed in the CISA KEV catalog, yet attackers could still craft simple CSRF requests. Exploitation requires an authenticated user to visit a crafted URL, implying that privileged users are the primary target. This could lead to untrusted modifications of site content or configuration, compromising confidentiality, integrity, or availability of the affected WordPress site.