This vulnerability in the WP Service Payment Form With Authorize.net plugin allows an attacker to exploit a CSRF flaw, which can be combined with reflected XSS to execute unauthorized actions with the privileges of an authenticated user. The affected versions are up to and including 2.6.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on plugin updates from the vendor.

Successful exploitation could allow attackers to perform unauthorized actions on behalf of authenticated users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The reflected XSS component may facilitate session hijacking or further attacks. However, no known exploits are reported in the wild, and the impact is limited to installations using this specific plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for plugin updates from the vendor is recommended. No official fix or temporary workaround is currently documented.