This vulnerability in PSM Plugins SupportCandy is a CSRF issue that affects versions up to 3.4.1. It allows an attacker to induce an authenticated user to execute unintended requests on the affected plugin, potentially leading to limited impact on the integrity of the system. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting a network attack vector with low complexity, no privileges required, but requiring user interaction. Confidentiality and availability impacts are not present, with only a low impact on integrity.

The impact is limited to a low integrity impact due to the CSRF vulnerability. There is no confidentiality or availability impact reported. The vulnerability requires user interaction and can be exploited remotely without privileges. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting actions to trusted users. Monitor vendor channels for updates regarding patches or official mitigations.