This vulnerability is an unauthenticated CSRF flaw in PublishPress Capabilities versions up to 2.50.1. It allows an attacker to trick a user into submitting a forged request that can cause high impact on the integrity and availability of the system. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

Successful exploitation can lead to unauthorized actions being performed on behalf of a user, potentially causing significant integrity and availability damage to the affected PublishPress Capabilities installation. There is no confidentiality impact reported. The vulnerability does not require authentication, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider mitigating CSRF risks by implementing standard CSRF protections such as verifying request origins and using anti-CSRF tokens where possible.