This vulnerability is a CWE-352 Cross-Site Request Forgery issue in the wpWax Legal Pages plugin for WordPress, affecting versions up to 1.4.2. It allows attackers to trick authenticated users into submitting unauthorized requests, potentially leading to limited impact on the integrity of the affected system. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No official fix or patch has been released yet, and no known exploits have been observed.

The impact is limited to low integrity compromise, meaning an attacker could cause minor unauthorized changes through CSRF attacks. There is no confidentiality or availability impact reported. The vulnerability requires user interaction and can be exploited remotely without authentication privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, or limiting exposure by restricting plugin usage to trusted users. Monitor official wpWax channels for updates regarding a fix.