The Multiple Admin Emails plugin by Phuc Pham suffers from a CSRF vulnerability in versions up to 1.0. This flaw enables attackers to execute unauthorized state-changing requests by exploiting the trust of an authenticated user. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a low to partial level. No patch or vendor advisory has been provided, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation of this CSRF vulnerability can allow attackers to perform unauthorized actions that affect the confidentiality, integrity, and availability of the affected system to a limited extent. Since the vulnerability requires user interaction and no privileges, it could be used to manipulate plugin settings or administrative functions if an authenticated user is tricked into submitting a malicious request. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonces or tokens in requests, restricting administrative access, and educating users about the risks of unsolicited links. Monitor the vendor's channels for updates or patches addressing this vulnerability.