The Eduardo addWeather plugin versions up to 2.5.1 contain a CSRF vulnerability that enables attackers to perform unauthorized actions by exploiting the lack of proper request validation. This vulnerability requires user interaction and can be exploited remotely without privileges. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low level.

Successful exploitation of this CSRF vulnerability could allow attackers to perform unauthorized actions on behalf of authenticated users, potentially leading to limited disclosure, modification, or disruption of data or service within the addWeather plugin context. The impact is rated as high severity due to the combination of factors in the CVSS score, but no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens, restricting plugin access, or disabling the plugin if not needed. Monitor official channels for updates from the vendor Eduardo regarding fixes.