This vulnerability is an unauthenticated Cross-Site Request Forgery (CWE-352) affecting Plugins Garbage Collector (Database Cleanup) versions up to and including 0.14. An attacker can trick a user into submitting a forged request that causes unintended actions on the affected application. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported in the wild, and no vendor remediation level or patch is currently documented.

The vulnerability allows an attacker to perform unauthorized actions by exploiting CSRF without authentication, potentially leading to unauthorized modification of data within the affected application. There is no impact on confidentiality or availability. The integrity of the system is at risk due to the possibility of malicious requests altering data or state.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens, enforcing same-site cookies, or other application-layer mitigations to prevent unauthorized requests. Monitor vendor channels for updates and official patches.