CVE-2026-22359 identifies a CSRF vulnerability in the AA-Team Wordpress Movies Bulk Importer plugin (versions up to 1.0). The vulnerability enables attackers to induce authenticated users to submit unauthorized requests, potentially leading to limited impact on the integrity of the application. The CVSS vector indicates the attack can be performed remotely without privileges but requires user interaction. Confidentiality and availability impacts are not present, with only a low impact on integrity.

The vulnerability allows an attacker to perform unauthorized actions by exploiting the trust of an authenticated user through CSRF. The impact is limited to integrity with no confidentiality or availability impact. There are no known active exploits, and the severity is rated medium based on the CVSS score of 4.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying nonces or tokens in requests if possible. Monitoring for updates from AA-Team regarding patches or mitigations is recommended.