The Michael Cannon Custom Bulk/Quick Edit plugin versions up to 1.6.10 contain a CSRF vulnerability that permits unauthorized commands to be executed on behalf of an authenticated user. The vulnerability is identified as CVE-2025-30946 with a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or vendor advisory is currently available to confirm remediation status.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions that may alter data integrity within the affected plugin. The impact is limited to low integrity loss without confidentiality or availability compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections at the application or server level, such as verifying origin headers or using web application firewalls to mitigate potential exploitation.