The Brevo WordPress plugin (versions up to 3.1.87) contains a CSRF vulnerability due to improper nonce validation in its Init() function. This allows attackers to forge requests that can log out authenticated Brevo connections if an administrator is tricked into interacting with a crafted link. The vulnerability does not impact confidentiality or availability but can cause an integrity issue by forcing logout. It is rated medium severity with a CVSS 3.1 base score of 4.3 (Network attack vector, low complexity, no privileges required, user interaction required, no impact on confidentiality or availability, low impact on integrity). No patch or mitigation has been officially released as of the published date.

An attacker can cause an authenticated Brevo connection to be logged out by exploiting this CSRF vulnerability, potentially disrupting administrative workflows. There is no direct impact on data confidentiality or system availability. The integrity impact is limited to forced logout actions. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should be cautious about clicking on untrusted links while logged into the Brevo plugin. Monitoring for updates from the plugin vendor (neeraj_slit) is recommended to apply patches promptly once available.