This vulnerability in the Youtube Video Grid plugin by codehandling allows CSRF attacks due to improper access control configurations. It affects all versions up to 1.9. The vulnerability enables attackers to induce state-changing requests on behalf of authenticated users without their consent. The CVSS 3.1 base score is 6.5, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or mitigation details have been provided by the vendor or in public advisories.

Successful exploitation could allow an attacker to perform unauthorized actions that affect the integrity and availability of the affected system or plugin functionality. There is no impact on confidentiality. The medium severity reflects the potential for disruption or unauthorized changes without user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin to reduce exposure. Implementing standard CSRF protections at the application level may help mitigate risk, but specific guidance from the vendor is necessary for complete remediation.