The saleandro Songkick Concerts and Festivals plugin (version 0.9.7 and earlier) contains a CSRF vulnerability that could allow attackers to perform unauthorized actions by exploiting the trust of an authenticated user. The vulnerability does not impact confidentiality or availability but may impact integrity by enabling limited unauthorized actions. The vulnerability is remotely exploitable without privileges but requires user interaction.

The vulnerability could allow an attacker to induce an authenticated user to perform unintended actions within the affected plugin, potentially altering data or settings. There is no impact on confidentiality or availability reported. The overall impact is limited to integrity with a medium severity rating (CVSS 4.3). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted users where possible.