This vulnerability in BP Disable Activation Reloaded plugin arises from improper ACL enforcement combined with susceptibility to CSRF attacks. An attacker could trick an authenticated user into submitting a request that performs unauthorized actions within the plugin. The vulnerability affects all versions through 1.2.1. The CVSS vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact is limited to integrity, with no confidentiality or availability impact reported.

Successful exploitation allows an attacker to cause an authenticated user to perform unintended actions within the plugin, potentially altering plugin behavior or settings without proper authorization. There is no reported impact on confidentiality or availability. The integrity of the affected system or plugin configuration may be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests, restricting access to trusted users, or disabling the plugin if feasible. Monitor official sources for updates from the vendor regarding patches or mitigations.