This vulnerability in Wow-Company's Button Generator – easily Button Builder plugin allows Cross-Site Request Forgery (CSRF) attacks. Specifically, versions up to 3.1.1 are affected. The issue enables attackers to induce authenticated users to perform unintended actions via crafted requests. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Successful exploitation could lead to limited integrity and availability impacts by causing users to unknowingly perform actions within the vulnerable plugin. There is no confidentiality impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted users. Monitor vendor channels for updates and apply patches promptly once released.