This vulnerability in the Child Themes Helper plugin (versions <= 2.2.7) combines CSRF with path traversal, enabling an attacker to trick authenticated users into executing unwanted actions that may lead to denial of service or other disruptions. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, no confidentiality or integrity impact, but high availability impact.

The vulnerability can cause high impact on availability, potentially disrupting the normal operation of the affected system. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates. Applying general CSRF mitigations such as verifying user actions and using anti-CSRF tokens may help reduce risk until an official fix is available.