The Rohit Choudhary Theme Duplicator plugin for WordPress versions up to 1.1 contains a CSRF vulnerability. This allows attackers to induce authenticated users to perform actions without their consent by exploiting the lack of proper request validation. The vulnerability does not require privileges (PR:N) but does require user interaction (UI:R). The impact is limited to integrity with no confidentiality or availability impact. No known exploits are reported in the wild, and no patch or official fix information is provided at this time.

An attacker could exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions within the Theme Duplicator plugin, potentially modifying plugin behavior or settings. The impact is limited to integrity with no direct confidentiality or availability consequences. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling the plugin if possible or limiting access to trusted users only. Monitor vendor channels for updates regarding a fix.