The WPExperts.io WP Multistore Locator plugin for WordPress contains a CSRF vulnerability in versions up to 2.5.2. This vulnerability enables an attacker to induce an authenticated user to submit unauthorized requests, potentially leading to limited impact such as unauthorized changes with user privileges. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. No patch or vendor advisory is currently provided.

The vulnerability allows an attacker to perform actions on behalf of an authenticated user without their consent, potentially leading to limited unauthorized modifications within the plugin's scope. There is no impact on confidentiality or availability, and the integrity impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider limiting exposure by restricting access to authenticated users and applying standard CSRF mitigations if possible. Monitor official WPExperts.io channels for updates and apply patches promptly once released.