This vulnerability in the wp-buy WP Maintenance Mode & Site Under Construction plugin allows CSRF attacks, where an attacker can induce an authenticated user to perform actions without their consent. The affected versions include all versions up to 4.3. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction, and impacts integrity with no confidentiality or availability impact. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation could allow an attacker to cause an authenticated user to perform unintended actions within the plugin, potentially modifying plugin settings or behavior. The impact is limited to integrity and does not affect confidentiality or availability. There are no known active exploits targeting this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting access to the plugin's administrative functions and ensure users are cautious about clicking on untrusted links that could trigger CSRF attacks. Monitor the vendor's channels for updates regarding patches or mitigations.