The vulnerability is a Cross‑Site Request Forgery flaw in the MIGHTYminnow Dashboard Notes plugin. An attacker can provoke a logged‑in administrator or user to submit requests that change the state of the site—such as creating or modifying notes—without the user’s knowledge. This leads to unauthorized changes but does not directly expose user data or grant code execution.

WordPress users running the Dashboard Notes plugin version 1.0.3 or earlier are affected. The plugin provides note‑taking functionality within the WordPress dashboard.

With a CVSS score of 7.1 the flaw carries a moderate‑to‑high severity. The EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires the victim to be authenticated to the WordPress site and to have a valid session; the attacker can trick the user into visiting a crafted URL or loading a malicious script that submits the CSRF request. No additional privileges are required beyond the victim’s credentials.