The Rustaurius Ultimate WP Mail plugin version 1.3.4 and earlier contains a CSRF vulnerability that could allow an attacker to trick authenticated users into submitting unauthorized requests. This vulnerability does not require privileges (PR:N) but does require user interaction (UI:R). The attack vector is network-based (AV:N), and the impact includes low integrity and low availability impacts, with no confidentiality impact. The vulnerability is publicly known as of May 7, 2025, but no patch or fix has been disclosed yet.

Successful exploitation of this CSRF vulnerability could allow an attacker to cause unintended actions within the Ultimate WP Mail plugin context, potentially leading to limited integrity and availability impacts. There is no confidentiality impact reported. The vulnerability requires user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the affected plugin or applying any recommended temporary mitigations from the vendor. Monitor official Rustaurius communications for updates on patches or fixes.