This vulnerability in the SK WP Settings Backup plugin arises from insufficient CSRF protections, enabling attackers to trick authenticated users into executing unwanted actions. The flaw specifically allows object injection, which can lead to severe impacts including full system compromise. The affected versions include all versions up to 1.0. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to an attacker injecting malicious objects via CSRF attacks, potentially resulting in full compromise of the affected WordPress installation's confidentiality, integrity, and availability. This could allow unauthorized changes, data theft, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the SK WP Settings Backup plugin to mitigate risk. Additionally, applying general CSRF mitigations such as ensuring strict user session validation and limiting plugin usage to trusted environments may reduce exposure.