This vulnerability is a CSRF issue in the hosting.io JPG, PNG Compression and Optimization WordPress plugin (wp-image-compression) up to version 1.7.35. It allows attackers to induce authenticated users to execute unwanted actions without their consent by leveraging the lack of proper request validation. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

Successful exploitation could lead to low integrity impact by causing unintended actions on the affected plugin through forged requests. There is no impact on confidentiality or availability. The vulnerability requires user interaction and no privileges, limiting the scope of potential damage. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor for updates from hosting.io or the plugin maintainers regarding patches or official mitigations.