The YITHEMES YITH WooCommerce Popup plugin contains a CSRF vulnerability in versions up to 1.48.0. This vulnerability enables attackers to perform unauthorized actions on behalf of authenticated users by exploiting the lack of proper request validation. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction. The impact is limited to integrity loss without confidentiality or availability impact.

An attacker could leverage this CSRF vulnerability to cause an authenticated user to perform unintended actions within the YITH WooCommerce Popup plugin, potentially altering plugin settings or behavior. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying nonce tokens or restricting access to trusted users. Monitor vendor communications for updates and apply patches promptly once available.