The Sync Post With Other Site plugin (version <= 1.9.1) by Kamlesh Parmar contains a CSRF vulnerability that could allow attackers to perform unauthorized actions by leveraging the victim's authenticated session. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No patch or official fix has been published yet, and the plugin is not a cloud service.

Successful exploitation of this CSRF vulnerability could allow attackers to cause authenticated users to perform unintended actions on the affected plugin, potentially impacting confidentiality, integrity, and availability at a low level. The scope of impact is changed, indicating the vulnerability affects resources beyond the vulnerable component itself. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the Sync Post With Other Site plugin if possible, and apply general CSRF mitigations such as ensuring proper anti-CSRF tokens are used in requests. Monitor official channels for updates or patches from the vendor.