This vulnerability is a CSRF issue in the No-Bot Registration plugin by Arnan de Gans, affecting versions through 1.9.1. It allows attackers to trick authenticated users into submitting unwanted requests, potentially causing unauthorized changes. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. The vulnerability does not affect confidentiality or availability but impacts integrity to a limited extent. No vendor advisory or patch has been published yet.

The impact is limited to integrity, where an attacker may cause a user to perform unintended actions within the affected application. There is no impact on confidentiality or availability. No known exploits have been reported, and the vulnerability requires user interaction to be exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing CSRF protections such as verifying anti-CSRF tokens on state-changing requests if possible. Monitor vendor channels for updates and apply patches promptly once available.