This vulnerability is classified as CWE-352 (Cross-Site Request Forgery) in the Cozmoslabs Paid Member Subscriptions WordPress plugin. It affects versions up to 2.11.0 and allows attackers to trick authenticated users into submitting unauthorized requests. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction and resulting in low impact on integrity without affecting confidentiality or availability. No vendor advisory or patch information is currently available.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions within the Paid Member Subscriptions plugin. The impact is limited to low integrity loss, with no direct confidentiality or availability impact reported. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing standard CSRF protections or disabling the plugin if feasible. Monitor vendor channels for updates.