The raratheme Construction Landing Page plugin version 1.3.5 and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue allows attackers to induce authenticated users to perform unintended actions without their consent. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a network attack vector with low complexity, no privileges required, and requiring user interaction. The impact is limited to integrity with no confidentiality or availability impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user, potentially modifying data or settings within the Construction Landing Page plugin. There is no impact on confidentiality or availability. The overall severity is medium based on the CVSS score of 4.3. No known exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or limiting user privileges to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.