This vulnerability is classified as CWE-352 (Cross-Site Request Forgery) in the Blocksy Companion plugin by CreativeThemes. It affects versions up to 2.0.28 and allows attackers to trick authenticated users into submitting unauthorized requests. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. The impact includes limited integrity and availability consequences. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of April 11, 2024.

An attacker could exploit this vulnerability to cause an authenticated user to perform unintended actions within the Blocksy Companion plugin, potentially leading to limited integrity and availability impacts. There is no indication of confidentiality impact. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider minimizing exposure by restricting access to trusted users and monitoring for suspicious activity related to the plugin. Avoid clicking on untrusted links while authenticated in affected systems.