This vulnerability is an unauthenticated Cross-Site Request Forgery (CWE-352) affecting Theme My Login plugin versions up to 7.1.14. It allows an attacker to trick a user into submitting a request that performs unintended actions without the user's consent. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation level has been published as of the data provided.

The vulnerability can lead to unauthorized actions being performed on behalf of a user without their consent, potentially altering data or settings. However, it does not impact confidentiality or availability. The medium severity and CVSS score of 4.3 reflect limited but non-negligible integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying request origins or using security plugins that provide CSRF mitigation. Monitor vendor channels for updates.