The sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) plugin versions up to 4.0 contain a CSRF vulnerability (CVE-2024-48031). This vulnerability enables attackers to perform unauthorized actions on behalf of authenticated users by exploiting the lack of proper CSRF protections. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause high availability impact on the affected system by triggering unwanted actions through an authenticated user's browser. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider implementing CSRF protections such as verifying nonces or tokens in requests if possible, or limiting exposure of the affected plugin's administrative interfaces.