The giangmd93 GP Back To Top plugin versions up to 3.0 contain a CSRF vulnerability that enables attackers to induce authenticated users to execute unwanted actions without their consent. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or remediation information is currently available, and no exploits have been observed in the wild.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions within the GP Back To Top plugin context. The impact is limited to low integrity changes, with no direct confidentiality or availability effects. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying standard CSRF mitigations such as disabling or restricting the plugin if feasible, or employing web application firewalls that can detect and block CSRF attempts. Monitor official vendor channels for updates and patches.