This vulnerability in BP Disable Activation Reloaded arises from improper access control combined with CSRF, enabling an attacker to perform actions on behalf of an authenticated user without proper authorization checks. The issue affects all versions up to 1.2.1. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges but requires user interaction, and it impacts integrity but not confidentiality or availability.

Successful exploitation could allow an attacker to perform unauthorized actions that modify or disrupt plugin functionality, potentially impacting the integrity of the affected system. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests related to the plugin's functionality. Monitor vendor channels for updates.