The vulnerability identified as CVE-2025-23820 is a CSRF issue in the Content Security Policy Pro plugin by thapa.laxman, affecting versions up to 1.3.5. CSRF vulnerabilities enable attackers to induce users to perform actions they did not intend by exploiting the user's authenticated session. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but user interaction is necessary. The impact includes potential confidentiality, integrity, and availability loss, each rated as low to partial. No patch or official fix details are currently available.

Successful exploitation of this CSRF vulnerability could allow an attacker to perform unauthorized actions on behalf of an authenticated user, potentially leading to partial loss of confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens on state-changing requests and limiting user privileges where possible.