This vulnerability in jesseheap WP PHPList (phplist-form-integration) allows Cross-Site Request Forgery (CSRF) attacks. It affects all versions up to 1.7. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation of this CSRF vulnerability could allow an attacker to induce an authenticated user to perform unintended actions within the WP PHPList plugin, potentially leading to limited disclosure, modification, or disruption of data or service. The impact is rated as high severity based on the CVSS score of 7.1. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting access to trusted users. Monitor official channels for updates from the jesseheap WP PHPList project regarding patches or mitigations.