This vulnerability is a CWE-352 Cross-Site Request Forgery issue in Cincopa Post Video Players versions up to 1.159. It allows attackers to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity and availability impacts. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. There is no vendor advisory or patch information available, and the product is not a cloud service.

The vulnerability can lead to unauthorized actions performed by users without their consent, impacting the integrity and availability of the affected system. Confidentiality is not affected. No known exploits have been reported in the wild, which may limit immediate risk. The medium severity rating reflects the moderate risk posed by this CSRF vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing standard CSRF mitigations such as verifying the origin of requests and using anti-CSRF tokens if possible. Monitor vendor communications for updates on patches or official mitigations.