This vulnerability is a CWE-352 Cross-Site Request Forgery issue in the CRM Perks Integration for Contact Form 7 and Constant Contact plugin, affecting versions through 1.1.5. It allows attackers to induce authenticated users to perform unintended actions via crafted requests. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No vendor advisory or patch information is currently available.

The vulnerability could allow an attacker to cause an authenticated user to perform unintended actions, potentially altering data integrity in a limited way. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing standard CSRF mitigations such as verifying request origins and using anti-CSRF tokens if possible. Monitor official vendor channels for updates and patches.