This vulnerability is a CSRF issue in the Just Variables WordPress plugin (versions <= 1.2.3) developed by Alex Prokopenko / JustCoded. It allows an attacker to perform unauthorized actions on behalf of an authenticated user by exploiting the lack of proper request validation. The CVSS 3.1 vector indicates the attack can be performed remotely over the network, requires no privileges, but does require user interaction. The impact is limited to integrity loss without confidentiality or availability impact.

The vulnerability could allow an attacker to cause a user to perform unintended actions within the Just Variables plugin context, potentially altering data or settings. There is no confidentiality or availability impact reported. The overall severity is medium based on the CVSS score of 4.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling the plugin or limiting its use to trusted environments. Implementing standard CSRF protections such as nonce verification may mitigate the risk if custom development is possible.