CVE-2026-24521 describes a CSRF vulnerability in the Kama Thumbnail plugin by Timur Kamaev affecting versions up to 3.5.1. The vulnerability allows an attacker to trick authenticated users into submitting unauthorized requests, potentially leading to limited impact on the integrity of the application. The CVSS vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. Confidentiality and availability are not impacted, only integrity is rated low impact.

The vulnerability impacts the integrity of the affected application by allowing unauthorized actions via CSRF attacks. There is no impact on confidentiality or availability. No known exploits have been reported, so the practical risk may be limited until exploitation is observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor or security advisories. Implementing standard CSRF protections such as verifying anti-CSRF tokens may mitigate the risk if feasible.