This vulnerability is a CSRF issue in the PPO Call To Actions plugin by Ngô Thắng IT, affecting versions up to 0.1.3. It allows attackers to induce users to perform unauthorized actions via crafted requests, potentially impacting the application's confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with partial impacts on confidentiality, integrity, and availability.

Successful exploitation could lead to unauthorized actions performed on behalf of authenticated users, resulting in partial loss of confidentiality, integrity, and availability of the affected system. The high CVSS score reflects significant risk if exploited, although no active exploits are currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens, restricting actions to POST requests with proper validation, or limiting user privileges to reduce risk.