This vulnerability in DeluxeThemes Userpro allows CSRF attacks, where an attacker can induce a logged-in user to perform actions without their consent. The affected versions are all releases before 5.1.11. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. The impact is limited to integrity loss without confidentiality or availability impact. No official fix or patch information is available at this time.

The vulnerability can lead to unauthorized actions being performed on behalf of an authenticated user, potentially altering data or settings within the Userpro application. There is no impact on confidentiality or availability reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or limiting the exposure of authenticated sessions. Monitor vendor channels for updates.