This vulnerability is a CSRF issue in the ChurchThemes Church Content – Sermons, Events and More WordPress plugin affecting versions up to 2.6. It allows an attacker to trick authenticated users into submitting unauthorized requests, potentially leading to limited integrity impact. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and unchanged scope. No official fix or patch has been published yet.

The vulnerability can lead to limited integrity impact by enabling unauthorized actions through CSRF attacks. There is no impact on confidentiality or availability. Exploitation requires user interaction and no privileges, making it moderately exploitable but with limited consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying standard CSRF mitigations such as disabling or restricting the plugin functionality, or limiting user roles that can perform sensitive actions. Monitor official ChurchThemes communications for updates on fixes.