This vulnerability is a CSRF issue in the EverAccounting Ever Accounting WordPress plugin (wp-ever-accounting) affecting versions up to 2.1.5. It enables attackers to induce authenticated users to execute unwanted actions without their consent. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability can lead to limited integrity impact by allowing unauthorized actions to be performed via CSRF attacks. There is no impact on confidentiality or availability. No known exploits are reported in the wild. The medium severity reflects the limited but non-negligible risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests, restricting user permissions, or disabling the plugin if feasible. Monitor official EverAccounting channels for updates and patches.