The Delete Original Image plugin by Carlos Minatti, versions up to 0.4, contains a CSRF vulnerability that could allow an attacker to induce an authenticated user to execute unwanted requests. The vulnerability does not require privileges (PR:N), has low attack complexity (AC:L), requires user interaction (UI:R), and impacts integrity with no confidentiality or availability impact. The CVSS base score is 4.3, reflecting a medium severity. No patch or official remediation information is provided.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions related to the Delete Original Image plugin, potentially leading to unauthorized modification or deletion of images. There is no reported impact on confidentiality or availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting access to trusted users. Monitor official sources for updates or patches from the vendor.