The TM Replace Howdy plugin for WordPress, developed by David Wood, contains a CSRF vulnerability in versions up to 1.4.2. This vulnerability enables attackers to induce authenticated users to perform unintended actions via crafted requests without their consent. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required. No official patch or remediation details have been provided yet.

Successful exploitation could allow an attacker to cause an authenticated user to perform actions they did not intend, potentially leading to limited integrity impact. There is no confidentiality or availability impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitor official sources for updates and apply patches promptly once released.