The lucksy Typekit plugin for WordPress versions up to 1.2.3 contains a CSRF vulnerability. This issue enables attackers to induce authenticated users to perform actions without their consent by exploiting the lack of proper request validation mechanisms in the plugin. The vulnerability does not require privileges (PR:N) but does require user interaction (UI:R). It has no impact on confidentiality or availability but can cause limited integrity impact. The vulnerability is network exploitable with low attack complexity.

An attacker can exploit this vulnerability to cause an authenticated user to perform unintended actions within the Typekit plugin, potentially altering plugin settings or behavior. There is no direct impact on confidentiality or availability, but integrity may be affected to a limited extent. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider limiting user interactions with the plugin and applying general CSRF protections such as verifying nonces or tokens in requests if possible. Monitor for updates from the vendor regarding patches or official mitigations.