This vulnerability is classified as CWE-352 (Cross-Site Request Forgery) in the Andy Moyle Emergency Password Reset product. It affects all versions up to and including 8.0. The issue allows an attacker to induce a user to submit unauthorized requests to the application, potentially leading to unintended actions being performed. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, requires no privileges but does require user interaction, and results in low impact on integrity without affecting confidentiality or availability. No vendor advisory or patch information is available to confirm remediation status.

The impact is limited to potential unauthorized actions triggered by CSRF attacks, which could lead to integrity loss in the Emergency Password Reset process. There is no direct confidentiality or availability impact reported. The vulnerability requires user interaction to be exploited and does not require authentication privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing CSRF protections such as anti-CSRF tokens, validating the origin of requests, or restricting password reset functionality to authenticated and verified users where possible.