The raratheme Education Zone plugin versions up to 1.3.4 contain a CSRF vulnerability that could allow attackers to induce authenticated users to execute unintended commands. The vulnerability does not impact confidentiality or availability but can affect integrity. The attack vector is network-based, requires no privileges, and user interaction is necessary. No patch or mitigation details are provided in the available data.

The vulnerability could lead to unauthorized actions being performed by authenticated users without their consent, potentially altering data or settings within the Education Zone plugin. There is no impact on confidentiality or availability reported. The medium severity reflects the limited scope and requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitor vendor channels for updates and apply patches promptly once available.