This vulnerability involves a CSRF flaw in the PluginsCafe Address Autocomplete via Google for Gravity Forms plugin (gf-google-address-autocomplete) up to version 1.3.4. The issue allows attackers to trick authenticated users into submitting unwanted requests, potentially leading to limited integrity and availability impacts. The vulnerability does not affect confidentiality. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and has low complexity.

The impact is limited to integrity and availability, as the attacker can cause unauthorized actions via CSRF but cannot directly access or disclose sensitive information. The medium CVSS score reflects this limited but non-negligible risk. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections manually or applying temporary mitigations such as disabling the plugin if feasible. Monitor the vendor's communications for updates on patches or official mitigations.