This vulnerability (CVE-2024-31936) is classified as CWE-352, indicating a Cross-Site Request Forgery issue in the UsersWP plugin by AyeCode Ltd. It affects versions prior to 1.2.6. The vulnerability allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to limited integrity and availability impacts. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. No official fix or patch has been documented yet, and no exploits are known in the wild.

The impact of this vulnerability is limited to integrity and availability, as indicated by the CVSS vector (I:L, A:L). An attacker could cause a user to unknowingly perform actions that alter data or disrupt service. Confidentiality is not impacted. Since no known exploits exist in the wild, the immediate risk is moderate but should be monitored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted links and consider implementing additional CSRF protections if possible. Monitor official AyeCode Ltd communications for updates on patches or mitigations.