The WP Matterport Shortcode plugin for WordPress contains a CSRF vulnerability (CWE-352) that could allow attackers to perform unauthorized actions on behalf of authenticated users. The issue affects versions up to 2.1.9. The vulnerability is exploitable remotely without privileges but requires user interaction. The CVSS v3.1 base score is 4.3, reflecting low impact on confidentiality and availability but limited integrity impact. No vendor advisory or patch is currently available to address this issue.

Successful exploitation could allow an attacker to induce an authenticated user to perform unintended actions within the WP Matterport Shortcode plugin context, potentially leading to limited integrity impact. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider limiting exposure by restricting access to the plugin's functionality or implementing additional CSRF protections at the application or server level if possible.