The vulnerability is a Cross‑Site Request Forgery flaw that allows any visitor to send a forged request to the Slider by 10Web plugin without authentication. The CVE description does not specify the resulting capabilities, but such a flaw could enable malicious actions that the plugin normally restricts, potentially affecting data, integrity, or availability of the WordPress site. The weakness is identified as CWE‑352 and manifests as insufficient CSRF protection in request handling logic.

The defect exists in the 10Web:Slider by 10Web WordPress plugin for all releases up to and including version 1.2.63. No additional or patched versions are mentioned in the supplied data.

The CVSS score of 7.4 indicates high severity. Because authentication is not required, any visitor can trigger the exploit, dramatically increasing risk. The EPSS score is 0.00174, indicating a very low probability of exploitation at present, but the lack of an authentication barrier and the potential for malicious actions still make this vulnerability a significant threat. It is not listed in CISA’s KEV catalog, but administrators should treat it as a significant business risk.