The PluginOps Feather Login Page plugin version 1.1.7 and earlier contains a CSRF vulnerability that could allow an attacker to perform unauthorized actions by exploiting the trust a web application has in the user's browser. The vulnerability does not require privileges or user interaction beyond UI interaction and has a network attack vector. The impact is limited to integrity with no confidentiality or availability impact reported.

The vulnerability could allow an attacker to cause a user to perform unintended actions on the affected plugin, potentially altering data or settings without the user's consent. There is no reported impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted origins if possible. Monitor vendor channels for updates and apply patches promptly once available.