CVE-2025-11954 is a CSRF vulnerability in WISECP software by Sitemio Information Technologies Trade Ltd. Co. It allows attackers to trick authenticated users into submitting unauthorized requests, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions through 20022026. The vendor has not responded to disclosure attempts, and no patch or official remediation guidance is available. The CVSS 3.1 base score is 8.0, reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this CSRF vulnerability could allow attackers to perform unauthorized actions with the privileges of an authenticated user, potentially leading to full compromise of confidentiality, integrity, and availability of the affected WISECP installation. Given the high CVSS score, the impact is significant. However, no known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing CSRF protections at the application or web server level if possible, such as validating anti-CSRF tokens or restricting sensitive actions to POST requests with proper validation. Monitor official channels for updates from the vendor regarding patches or fixes.