This vulnerability in Leadfox for WordPress (<= 2.1.9) is a Cross-Site Request Forgery (CSRF) issue that could allow an attacker to induce an authenticated user to execute unintended actions within the plugin. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability to a limited degree. No official patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation could lead to unauthorized actions performed with the privileges of an authenticated user, potentially resulting in limited confidentiality, integrity, and availability impacts within the Leadfox plugin environment. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting plugin usage to trusted users and environments and avoid interacting with untrusted web content while authenticated. Monitor official Leadfox or WordPress plugin channels for updates.