This vulnerability (CWE-352) in OptinMonster Popup Builder Team's OptinMonster product allows an attacker to perform Cross-Site Request Forgery attacks. The affected versions include all versions up to 2.15.3. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. The impact is limited to integrity loss without confidentiality or availability impact. No patch or official remediation level has been disclosed as of the publication date.

The vulnerability could allow an attacker to trick a user into submitting unauthorized requests that may alter data or settings within the OptinMonster application. The impact is limited to integrity, with no direct confidentiality or availability impact reported. There are no known active exploits in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying request origins or using anti-CSRF tokens if possible. Monitor vendor channels for updates and apply patches promptly once available.