This vulnerability in the Tusko Trush Advanced Custom Fields : CPT Options Pages plugin (versions up to 2.0.9) allows an attacker to exploit a Cross-Site Request Forgery (CSRF) flaw to perform unauthorized requests that lead to object injection. The CVSS 3.1 score of 8.8 indicates a high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and full confidentiality, integrity, and availability impact. The vulnerability is publicly disclosed but no patch or vendor advisory is currently available.

Successful exploitation of this CSRF vulnerability can allow an attacker to inject objects, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This could enable unauthorized changes or control over the system using the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the affected plugin to prevent exploitation. Monitor for updates from the vendor or trusted security sources.