The vulnerability identified as CVE-2026-24554 in the Convers Lab WPSubscription plugin is a CSRF issue classified under CWE-352. It affects versions up to 1.9.1 and allows attackers to induce authenticated users to perform unwanted actions via crafted requests. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and requiring user interaction. Confidentiality and availability impacts are not present; only integrity impact is low.

The impact of this vulnerability is limited to a low integrity impact, meaning an attacker could cause unauthorized state changes or actions through CSRF but cannot access or modify confidential data or disrupt service availability. Since no known exploits are reported, the immediate risk is moderate but should be monitored.

No official patch or remediation is currently available for this vulnerability. Users of WPSubscription up to version 1.9.1 should monitor vendor advisories for updates. In the absence of a patch, mitigating CSRF risks generally involves implementing anti-CSRF tokens and ensuring proper user interaction validation, but specific guidance from the vendor is not provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.