This vulnerability in the Contact Form 7 reCAPTCHA plugin allows CSRF attacks, where an attacker can cause an authenticated user to perform unintended actions without their consent. The affected versions include all releases up to 1.2.0. The CVSS vector indicates the attack can be performed remotely with low complexity and requires user interaction, but does not result in confidentiality or availability impact, only limited integrity impact.

An attacker could exploit this vulnerability to induce an authenticated user to submit unauthorized requests to the Contact Form 7 reCAPTCHA plugin, potentially altering plugin behavior or settings. The impact is limited to integrity with no direct confidentiality or availability consequences reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections at the application or web server level if possible, or limit access to trusted users. Monitor official sources for updates and apply any official fixes once released.