A Cross‑Site Request Forgery (CSRF) flaw exists in the MailPoet plugin for WordPress, which allows an attacker to trick an authenticated user into sending unintended HTTP requests that are processed with the user’s privileges. Because the flaw involves the user’s authenticated session, the attacker could potentially trigger any action that is permitted to the victim within the MailPoet plugin, such as sending emails or modifying subscriber lists. The vulnerability is classified as CWE‑352, and the description indicates it is a straightforward CSRF issue without additional exploitation conditions.

MailPoet, a WordPress plugin, is affected in all releases from version 5.30.0 through 5.33.0 inclusive. No other vendors or products are listed as impacted.

The CVSS score of 7.1 indicates a moderate‑to‑high severity vulnerability. The EPSS score of less than 1 % suggests that exploitation is unlikely at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based CSRF request sent in a browser session while the user is authenticated to WordPress. Exploitation requires the victim to have adequate privileges within the site and to be lured into executing a malicious link or form from an external site.